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Introducing Microsoft Windows Server 2003. Do more with less. 



You're being asked to do more. You're being asked to do it with less. Microsoft' Windows Server 2003 is design 
to help you manage these opposing forces with powerful server consolidation capabilities that increase efficiency, 
decrease man-hours, and lower your total cost of ownership. Download your free evaluation copy of Windows 
Server 2003 at microsoft.com/windowsserver2003 Software for the Agile Business. 

► Information Resources, Inc. (IRI) manages over 122 terabytes of data to provide consumer ttehavior insights, advanced 
analytics, and decision analysis tools for some of tt\e largest consumer packaged goods, healthcare, retail, and financial 
companies in the world. To meet increasing demand for faster, more granular business intelligence while reducing 
costs, IRI is using 64-bit editions of Windows Server 2003 and SQL Server " 2000 on an Intel Itanium 2 system to 
deliver faster answers to its customers. The result? IRI will be able to process more queries, using a fraction of the 
number of servers while realizing significant cost savings and improving customer service. 





ONLY ONE REPORTING 
WORKS ACROSS DEPART 
ACROSS DIVISIONS. ACRO 

INTRODUCING COGNOS 



It's not an evolution. It's a revolution. 

Introducing Cognos ReportNet the new enterprise reporting standard. 

Now, you can deliver consistent information across your business. 

Replace stand-alone reporting tools with the only solution that handles 

everything from customized queries to production reports. 

Build reports once. Deploy in any language. Automatically. 

Make your IT team and users more productive. 

All on a zero-footprint, open architecture built specifically for the Web. 

See how you can drive performance. 
Read about Breakthrough Reporting at: 





Copyright O 2003 Cognos incorporated. All rights reserved. 
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The Standards 

The Battle for Web Services I 54 

Everyone wants Web services standards. CEOs think the technol- 
ogy will create new opportunities. CEOs believe it will save mil- 
lions. Vendors see a pot of gold at the end of the Web services 
rainbow. And CIOs know that linking to customers and partners 
over the Internet will revolutionize both business and IT. So what's 
the holdup? The usual suspects: Politics. Ego. Suspicion. Fear. 
Greed. By Christopher Koch 

The Early Adopters 
Calculated Risks I 64 

Many companies are jumping in to Web services before standards 
emerge. Sure, there are risks. Here's how some early adopters are 
managing them. By Elana Varon 



POST-IMPLEMENTATION AUDITS 
It Ain't Over...Untll You Do the 
Post-Implementation Audit I 74 

Scrutinizing every aspect of a finished projea and acting 
on the lessons learned can be controversial and difficult. But 
post-implementation audits are an important way to avoid 
repeating costly mistakes. By Meridith Levinson 

LEADERSHIP 

The Business Education of Jan Franklin I 84 

Just when she thought she knew everything, this IT veteran sp>ent 
some time on the business side. What she learned there prepared 
her to take over as Farmers' CIO when opportunity' knocked. 
By Alice Dragoon 

MORE 



Players in the Web services battle (from left to right): 
Kaiser Permanente's Dave Watson, Sonic Software's 
David Chappell, Oasis's Patrick Gannon, Motorola's 
Samir Desai and the U.S. Navy's Monica Shephard 
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AT&T Wireless works. 



average 
20-40 Kbps 



Sprint works nearly twice as fast. 



average 
50-70 Kbps 




Your business can get more done, faster, in more places 
nationwide with the Sprint advanced wireless network. 



Compared with the AT&T Wireless Next Generation network 
Sprint gives you: 

• Laptop connections nearly twice as fast 
•30% larger coverage area 
•35 million more people covered 



All of this and, of course, clear calls on the 
most complete, all-digital wireless network in 
the nation to make your business more effective 

Get the facts at www.sprintpcs.com or call 877-459-8144 
for a PCS Business Representative. 




PCS Connection Card."* 
Insert it m a laptop. 
Get a wifeless 
connection. 




Sprint 



One Sprint. Many Solutions?'^ 

Votce/Data PCS Wireless Internet Services E-Business Solutions Managed Services 



Speed claims based on published averages from each carrier and other information. Realized speeds will vary based on devices, tasks and other factors. Coverage claims based on 
the enhanced Sprint Nationwide PCS Network (reaching 240 million people) and the AT&T Wireless National Next Generation IGPRSI network and coverage included with available 
service plans excluding roaming areas. Copyright ©2003 Sprint Spectrum L.P. All rights reserved. Sprint and the diamond logo are trademarks of Sprint Communications Company L P 
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Value Management 

. Business Intelligence & Analytic^ 



IT Portfolio Management 

► Application Outsourcing^ 
^ Content Management 
^ IT Effectiveness 
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ROlA/alue Management 



Build more business value into your IT investments 

With mounting profit pressures and demands for cost control, every investment must produce rapid and predictable 
business value. As the worlds third largest IT company, Fujitsu can show you how to improve your return on IT. Our 
experienced consultants will align your technology with your business strategy for improved performance. And our 
enterprise value management, application outsourcing and IT effectiveness experience can help maximize the value 
from IT while reducing total IT costs up to 30% in three years. Along with the right blueprint, a solid infrastructure 
forms the foundation for business effectiveness. By eliminating "server sprawl? our exceptionally reliable and scalable 
UNIX servers will lower TCO and improve productivity. For free white papers showing how to maximize your Return 
On IT. visit us.fuiitsu.com/R01T . Working together, we can accomplish anything. 

Cr; 



IT Infrastructure Solutions 
High-Availability Servers 
Mission Critical Managed Service 
Resource Optimization Solutions 




FuflSU 



THE POSSIBILITIES ARE INFINITE 



us.fujitsu.com 
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PEER TO PEER 

Culture Clash I 40 

You don't need a degree in anthropology 
to negotiate multicultural IT projects. But 
as this IT exec discovered, having one sure 
doesn't hurt. By Patricia Ensworth 
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Putting It All Together Again I 44 

Knowledge worker productivit)': your 
questions answered. By Tom Davenport 
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Wanted: Metric Skeptics I 50 

Accepting vague or irrelevant numbers for 
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decisions. By Jack Keen 
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Readers weigh in with their opinions on 
this thorny issue. By Art jahnke 
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Beware of the Telephone I 96 

Most of your employees think hacks origi- 
nate via a computen According to Kevin 
Mitnick, they'd be wrong. By Gary Beach 
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Your Guide 
to Managing 

Secrets to Managing Techies 

IT employees are different. Here's how to 
lead them. By Megan Santosus 

Management Report I 102 

TTie Loyalty Lag: 10 ways to develop the 
truly loyal employee. 

Leadership Agenda I 104 

The M.I.A. CIO; Five ways to regain your 
focus — and retain your job. 
By Susan H. Cramm 




George Lin. CIO of Documentum. requires all IT 
staffers to understand business processes before 
ttiey can tall< technology. 
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It's not just what you send, it's what you 

store that needs encryption. 

ON THE MOVE I 34 

CIOs on the go — see where your 

IT peers are working now. 

PROFILE: Dana Deasy's easy move to 

troubled Tyco International. 
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"Since all knowledge workers aren't alike, we need 
to segment them into categories and apply IT 
approaches differently for each category." 

-Tom Davenport, CIO columnist, on knowledge workers Page 44 
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All those who want more wireless ^ ! 

with less worry... D3y I 




Technology Risk 



protiviti 

I Independent Risk Consulting 



Wireless networks offer businesses several advantages. Increased 
mobility, design flexibility, lower costs. But as with most new 
technologies, design focuses on functionality - not risk. 
Wireless technologies do not have the physical access 
restrictions used in traditional wired environments. They make 
it possible for someone in the lobby or across the street to have 
access to a network carrying patient or employee information, 
sensitive corporate data, or trade secrets. 

Are your wireless access points configured with adequate 
security? Has your business taken steps to prevent hackers 
from exploiting your information? Do you know your 
vulnerabilities? "War driving." "Net stumbling." "War chalking." 
"LAN jacking." From wireless to business continuity, 
infrastructure management to security and privacy, Protiviti 
helps you identify, measure and manage the technology risks 
that threaten your business objectives. That way, you can 
manage your risks, not just react to them. 



Protiviti is the leader in independent risk consulting and 
internal audit services. We provide international services for 
established and emerging companies to help them inde- 
pendently identify, measure and better manage risk. Our Big 
Four experience ensures years of expertise in a wide range of 
industries. So whether your challenge is reporting accurate 
results, maximizing the value of technology or adopting 
business controls you can trust, Protiviti delivers quantifiable 
solutions that make a difference... Are you ready to Say i? 

For more information visit protiviti.com or call 
1.888.556.7^20. 



Visit KnowledgeLeader.com today for a free 30-day trial. 

KnowledgeLeader.com provides exclusive tools, resources and 
best practices to help internal auditors and risk professionals. 



© 2003 Protiviti inc. EOE 
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L V'vy W"^ O How do you become the nation's foremost business magazine? With unparalleled 
JL VrJL L^^^S ! vision and absolute clarity. That's why Forbes chose to utilize displays from Samsung 
— the world's leading manufacturer of TFT-LCD displays. And with technology like the new SyncMaster 
192T, the tradition of excellence continues with the truest color reproduction, sharpest imaging and smartest 
overall investment. Together with Samsung, there's an even brighter future for publishing and beyond. 



Add vision. Add possibility. Add Samsung. 



IhgERACTIVE 
>reatures 



from October 1 to October 15 




ASK THE SOURCE 



How Does One Deploy 
Web Services? 



According to Samir Desai, senior vice presi- 
dent and CIO at Motorola, Web services is 
about "the throughput, agility and cost- 
effectiveness of IT. How many times should I 
code a credit card check? With Web services 
the answer is one." Motorola has committed 
to the enterprisewide deployment of Web 
services (see Calculated Risks. Page 64). 
Quiz Desai on his experiences with Web 
services through Oct. 15. Go to www2.cio.com/ask/source. 

ADD A COMMENT 

Web Services: The Next New Thing or the Newest Headache? 

If the vendors can't agree on the standards, maybe it doesn't make sense for you to launch into 
Web services just yet. (See The Battle for Web Services, Page 54. ) Or maybe this is the time to 
get the jump on the competition. What's your take? Go to the online version of this article to 
Add a Comment— and read what your peers are thinking. 



LEARN MORE 




Nailing the Post-Implementation Audit 

What you don't know can hurt you. By doing a post-implementation audit (see It Ain't Over 
Until You Do the Post-Implementation Audit, Page 74), you'll get a clear picture of what not 
to do next time— and solid backup to prove the value of high-cost, mission-critical IT invest- 
ments. The following Web exclusives will help you nail down doing the PIA, and doing it right: 



■■■ A Business Case Process, including 
sample flow chart that identifies key 
metrics and project time line 
► APIA Scorecard, for planning the 
four-step process 



A PIA Summary, for tracking major steps 
'~ Also look for informational sidebars on 
"How to Select the Right Project for Your 
First Post-Implementation Audit" and "Doing 
It Right: Questions to Ask During an Audit." 



Peer Resources 

More Takes on Web 
Services 

» If Web services ever gets its 
various acts together (see The 
Battle for Web Services. Page 54). 
it's |ust possible that the end user 
could be responsible for his own 
applications. Where does that leave 
the IS department? C/O's sister 
site Darwinmag.com thinks that 
might mean we don't need IS 
anymore. Read Are You Ready for 
the IT-Savvy Company? on 
www.clarwinmag.com. 

» Even though organizations such 
as Motorola and the Navy are 
plunging ahead with Web services 
(see Calculated Risks, Page 64). 
they're all going to have to deal with 
the technology's avowed lack of 
security. C/O's sister publication 
CSO magazine offers some tips for 
Web services pest control in How to 
Rope in Rowdy Technologies. Find 
the story at www.csoonline.com. 



Online Exclusiv 



on just how Web 
services works? 
Check out ournewly 
updated interactive 
Flash presentatio 



www.clo.com/prlntlinks 
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Open standards and 
the taming of the screw. 



In 1864, a bolt or screw made in one machine shop wouldn't fit a nut made 
in another machine shop. Everything was proprietary. In short, a mess. 

Until William Sellers proposed a standard, uniform screw. So one part 
could be made down the street, and another made across town, and 
assembly could happen anywhere. Everything worked together. 

Apply that same logic to IT and you arrive at open standards like Linuxf 
Universal, open "languages" that let everything IT talk to everything 
else IT. Vendors, systems, partners — anyone — can be plugged into or 
unplugged from the open standards "pegboard." Open standards is 
also the antidote to being locked into the high costs of any one vendor. 
The business results? Speed, responsiveness, flexibility, readiness. 

Open standards. The unifying thread behind on demand business. 



IBM is home to thousands of people who live and breathe Linux. 
Specialists who can bring open standards (and all its benefits) to just 
about every industry. Our IT expertise, coupled with deep business 
know-how, can deliver real change across your company. On demand 
business. Get there with on demand people. Call 800 IBt^ 7080 (ask 
for thinking) or visit ibm.com/services/thinking 



On demand business starts with on demand thinking. 




see 




IBM and the IBM logo are trademarks or registered trademarks of International Business Machines Corporation in the United States and/or other countries. Linux is a registered trademark of Linus Torvalds. 
©2003 IBf^ Corp, All rights reserved 



From the Editor 

luudberg@cio.com 





The discussion on strategic 
planning and alignment that 
I had with members of ClO's 
Best Practice Exchange is 
just one of many taking 
place every day. For more 
information on the Best 
Practice Exchange, our 
member-only online 
networking forum, visit 
exc/iange.cio.com. 



The Greatest Threat 
to CIO Success 



RIGHT NOW, ClOs ARE STUCK between a rock 
and a hard place. On one side, there is growing 
demand for new IT capabiHties and high expecta- 
tions for payoff. On the other, there are greatly 
constrained resources. This will pose the single 
greatest threat to CIO effectiveness in the next year 
and a half, and there's only one way out: better 
strategic planning and business alignment. 

In a recent CIO.com poll, we asked visitors if 
they were experiencing an increase in FT requests 
from the business side. Of 405 respondents, 78 per- 

ccnt said the nuinlx-r of requests is increasing. And 
32 percent said the quality of the requests is improv- 
ing (better spec'ed out, higher-value projects). 

If IT budgets were incTeasing by double digits, as 
was common in the late '90s, that might not be a 
problem. When money flowed freely, as long as 
the IT organization was aligned with what the busi- 
ness needed and delivered it well, the CIO was con- 
sidered successful. 

That type of alignment is a recipe for disaster 
for CIOs today. When IT tries to please each and 
every business unit leader, each and every function 
head, and those people have competing priorities, 
there's no way to win. With resources as limited 
as they are today, you wind up with a scene from 
Gladiator, with the CIO stuck in the middle of a 
very bloody battle. 

I recently asked members of CIO's Best Practice 
Exchange to describe the most effeaive thing they 



were doing to manage this problem. To a person, 
the answer was better strategic planning and align- 
ment in the business, and better governance of IT. 

The only way to be successful when the number 
of high-value business initiatives (IT enabled or oth- 
erwise) greatly exceeds the resources available to 
deliver them is to get all the business stakeholders to 
agree on what is most important, and then to agree 
on how things should be prioritized. That takes a 
cohesive executive group and some very sophisti- 
cated, well-running governance mechanisms. 

The challenge in this for CIOs is that, in most 
companies, this isn't happening, and the CIO who 
identifies the problem/solution ends up in a new 
high-profile role of leading the business to priori- 
tize, define and communicate goals for the entire 
enterprise — not just for any one business unit or 
function, and not just for FT. Second only to the 
CEO, CIOs are uniquely positioned to view the 
business in this cross-functional, process-oriented, 
holistic way. Second to no one, they are uniquely 
positioned to think about and lead discussions on 
IT-enabled strategy' and process change. Think this 
is a stretch? I've talked with two CIOs in the past 
month who are writing their companies' five-year 
strategic plans. 

Do you agree that this growing imbalance 
between demand and resources poses the greatest 
threat to your effectiveness? What about this new 
alignment? Drop me a line and let me know. 
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EDS EXPECTS $100,000,000 IN 
PRODUCTIVITY SAVINGS. ' 



YOU CAN TOO. 



Using Opsware, EDS is automating more than 15,000 
servers worldwide. And only EDS Automated Hosting 
offers clients a 100% uptime guarantee. 

It s here. Truly automated IT. 



^^^^ 



www.opsware.com/automatelT 



OPSWARE INC 

^ ^^f^ Automating IT' 



InBox 

Reader Feedback 



I.T. WILL DRIVE THE FUTURE 

I enjoyed your interview with economist W. Brian Arthur ["IT Reloaded," July 15, 2003] 
and understand and agree with what he says regarding ClOs becoming ever more central 
to the success of companies that themselves are relying more on technology. Indeed, those 
corporations are finding entirely new paths open to them, thanks to technology. 

However, I confess to wondering just how much real growth is still possible, given the other 
impact of technology. It seems to me that our society is in for a sea change insofar as our ability 
to support ourselves with work in the traditional manner. We still live in a culture where not 
having a job (and not "being productive") is frowned upon; most people in the United States 
feel shame if they are forced into an out-of-work situation. However, technology in many forms 
has taken away the need to employ as many people to accomplish the same tasks. 



To use Arthur's example, the railroads 
surely did allow for Chicago to become 
the capital of the U.S. beef industry, but 
did they not also eliminate the need for 
countless local butchers and cowboys? 
Or farming — in 1900, the census showed 
the U.S. population was 76 million peo- 






pie, with about 30 percent of them work- 
ing on farms. Today, less than 2 percent 
of a total population of 28 1 million work 
on farms in America, thanks to tractors 
and pesticides and genetic alteration. 

There are other more techy exam- 
ples — bank tellers displaced by ATMs, 
telephone operators by ESS switches, pro- 
grammers by offshore counterparts who, 
thanks to telecommunications, can deliver 
the same work results for less cost. 

My point is, we are still producing 
enough food (even surplus), getting our 
banking transactions and phone calls 



completed, and so on. The tasks them- 
selves are being accomplished, just with 
fewer people (or fewer people in the 
United States) involved. 

But what happens to those who would 
like to work but can't find jobs? 

I remember a sci-fi story called "The 
Marching Morons," written in the '50s. 
The protagonist (who had been frozen 
and then thawed 200 years in the future) 
discovered a world where a minority of 
people did productive work; the rest of 
the population went to work every 
day unaware their efforts did not 
accomplish anything. The minority 
set up "busy work" so that the 
masses would feel as if they were con- 
tributing members of society. 

That story comes to mind as I observe 
what we are experiencing as a society. 
Bob Fately, Vice President, Third Wat'e 
Van Nuys, Calif. 

Economist W. Brian Arthur Responds: 
With the steady increase of productivity 
coming mainly from IT, more work is 
indeed being done ivith fewer workers. 
I'm an optimist about the potential of IT 
and of the U.S. economy in general. But 
the fly in this very good ointment is the 
steady migration of jobs offshore and a 



prospect that jobs will recover last in this 
economy, if at all. 

I believe continued cutting-edge tech- 
nology will create new industries to off- 
set the losses in the old: witness genomics, 
smart materials, new pharms, nanotech. 
But these are some way off. I hope that 
the United States will take a cue from 
Europe and shorten the workweek. This 
means making it cheap by every possible 
means for businesses to hire labor. But 
failing that, we could see a situation here 
of combined prosperity and joblessness. 

I've been noticing that underneath the 
bad economic data, businesses large and 
small have been gradually absorbing the 
new technology. It has simply taken time 
to absorb, but the growth is inexorable. 

Arthur, whom I consider one of the 
smartest people around, has confirmed 
my hunches with historical insights. IT is 
indeed the wedge that will drive the 
future, although like any wedge, it takes 
many thrusts before its work is done. 

Paul Arveson 
Balanced Scorecard Institute 

CORRECTION 

An item in the Sept. 1, 2003, "On The 
Move" column erroneously referred to 
Lucent Technologies' financial situation. 
The company has not declared bank- 
ruptcy. CIO regrets the error. 



WHAT DO YOU THINK? 

Send your thoughts and feedback 
to lcttcrs@ci().C(>m. Letters may be 
edited for length or clarity. For a 
link to the article mentioned, go to 
wivw.cio.comlprintlinks. 
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"Deploying our ERP application 
on our tight deadline would 
have been impossible. With 
Citrix, we not only made our 
deadline, we also drastically 
reduced our deployment costs." 

Curtis Robb, CIO 
Delta Air Lines, inc. 

INFRASTRUCTURE FOR THE ON-DEMAND ENTERPRISE 

In the airline business, being on time is everything. 
And for Delta Air Lines, their ERP deployment was 
no exception. But with 12,400 individual desktops 
to manage, they needed a faster route to meet their 
deadline. So they turned to Citrix for a simplified 
and more cost-effective solution. Not surprising, 
considering that 99% of the Fortune 500 use Citrix* 
software to deploy applications centrally for secure, 
easy, and instant access to business-critical information 
- anywhere, anytime, from any device. We call it 
the on-demand enterprise. And it's helping more 
than 120,000 of our customers save money and 
reduce IT complexity. To learn what it can do for 
your business, visit www.citrix.com. 

cItrix 



I AM A CISCO 7960G 
IP PHONE. 



I AM MORE TALK 
AND LESS WALK. 

I HAVE MORE WAYS OF GETTING PEOPLE TALKING. BUT I AM 
NOT ALL TALK. I AM VOICE AND DATA, BOTH ON THE SAME TEAM. 
I HAVE THE POWER TO PUNCH TIME CLOCKS, LISTEN TO EMAIL 
AND SCHEDULE APPOINTMENTS. I HAVE THE POWER TO SAVE 
VALUABLE MILEAGE ON OFFICE MOVES AND I.T STAFF SHOES. 
I AM A SECURE, PINT-SIZED PRODUCTIVITY EXPERT THAT DELIVERS 
SUPER-SIZED ROI. 1 AM MORE THAN A CISCO 7960G IP PHONE. 




clsco.com/convergencenow 
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New York Institute of Technology's fiber optic network is 
one of the fastest on the East Coast. To make the most of it, 
NYIT graduated to Xerox multi-function technology. 
There's a new way to look at it. 
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P U B L I C- - S E C T O K I . T . 

Crazy as Usual 
for California CIO 



IMAGINE A TYPICAL DAY in the life of 
California CIO J. Clark Kelso. 

The state department of IT that Gov. 
Gray Davis picked him to clean up? Dis- 
banded. The state's budget? A $100 billion 
mess, balanced through billions in borrow- 
ing, slashed spending and new fees. And his 
job security? As far as Kelso knows, Arnold 
Schwarzenegger soon could be his new boss, 
thanks to a free-for-all gubernatorial recall 
vote set for Oct. 7. And that's if the new 
governor keeps him on. (Adding to the 
chaos: On Sept. 15, a court ordered the vote 
delayed until March.) 

But Kelso, a Sacramento insider with a 
reputation for turning around departments 



in turmoil, says it's all just politics as usual. 
"The mass media coverage is all about what 
a circus it is out here," says Kelso, a McGe- 
orge Law School professor who has helped 
revive the state's earthquake relief agency 
and insurance commission. "On the inside, 
you don't have the sense that the govern- 
ment is in utter chaos." 

Crisis is a better word for California's 
administration, a situation that extends to 
IT. Aside from the state's first-ever recall 
election, California must shore up its 
finances against another mammoth budget 
deficit next year (the deficit hit $38.2 bil- 
lion this year before a July budget deal). 

In the midst of this, Kelso tries to move 



Edited b\ Michael Goldberg 



California CIO J. Clark Kelso 

says state agencies forced 
to draw up plans for 20 per- 
it budget cuts will find 
mselves relying more on 
0 support core services. 



ahead with his IT agenda designed to cut 

costs without hurting services. He's drafting a 
data center consolidation plan due Dec. 1, to 
implement in 2004. His administration is 
overseeing an $800 million contract for IBM 
and other vendors to build a new system to 
administer child supptirt payments. And since 
he became CIO in 2002, Kelso has been pur- 
suing a statewide initiative to cut costs by 
improving interagency collaboration on the 
state's MyCalifornia Portal (iinoii'.nry.ca.gov). 
(For more about Kelso's goals on the portal, 
see "Dire States," uuw.cio.com/priiitlinks.) 

Guiding his actions, Kelso says, is restor- 
ing stability to the state budget, a factor that 
Continued on Pane 26 
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Dial C for Customer 

PITY THE POOR TELEMARKETERS. Starting today, 
these companies that would normally use computers 
to dial the masses instead must avoid connecting to 
one of 30 million telephone numbers listed in the 
Federal Trade Commission's National Do Not Call 
Registry. Violators risk fines. So, it would appear, you dine in peace. 

Well, not exactly. Telemarketers have been investing in CRM and 
other applications to help them navigate the list of government rules 
so that they can connect with eligible consumers. (For example, a 
company may contact customers for 18 months after a purchase.) 

Aegis Communications Group, an outsourcer that operates 
12 telemarketing and customer service call centers, has spent 
$1.8 million since 2000 to replace its homegrown software with 




7j plans to cc 
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PeopleSoft applications. Aegis 
convert half of its 5,100 
the software by next year 
Gaye Weinberger, senior vice 
president of business requirements, 
says the investments will make Aegis com- 
pliant with the Do Not Call list and trickier-to- 
manage rules, such as limits on the use of automated 
dialing software. Aegis, which saw its revenue cut by 
almost half between 2000 and 2002 (when it hit $135.9 million), 
wants to use the systems to better analyze data about existing and 
potential customers. 

The Direct Marketing Association, which is battling the Do Not 
Call rules in court, expects more efforts like this, says spokesman 
Jim Conway. "A common thread running through the preparations 
of our members is the realization of the increased value of the 
[existing] customer relationship," he says. -SXacy Cowley 
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Seeing is believing 



Finally, there's a system that delivers the information you need, when you 

need it for better IT business decisions. Blazent software automatically and 
continuously analyzes your enterprise-wide IT assets and resources, telling you exactly what you have 

and how much - or how little - it's utilized. Best of all, Blazent intelligence reports clearly identify 
how you can optimize the financial performance of your IT infrastructure. To learn more about Blazent 
IT intelligence software, visit www.Blazent.com. Information yOU can act on. 




See your own IT savings and believe it! 

Call 650.286.5500 to know if you qualify for a free 
30-day optimization assessment. 

O2003 Blazent Inc. Blazent and the Blazent logo are trademarks of Blazeni, IrK. 
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California CIO 
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will atfcct strategic 11 decisions for years and force depart- 
ments to focus on their essential needs. "We need all depart- 
ments to go back and ask themselves, 'Alright, given a 15, 
20 or 30 percent reduction over a two- or three-year period, 
what do we really think are the core business operations 
that we should Ix' performing?"" 

Ironically, Kelso expects this kind of scrutiny to cause 
some departments to save money by increasing, rather 
than decreasing, their dependence on IT. 

A case in point is Kelso's plan to consolidate Gilifomia's 
two data centers in Sacramento and Rancho Cordova. 
"We're not sure whether those data centers will actually 
have less business to do or more business to do," says 
Kelso. Departments may see the move to one consolidated 
data center as a way of automating manual processes, or 
of simply consolidating IT sen iccs — e-mail or Web sen ers, 
for example — that are now handled at the departmental 
le\ el, he says. It also could be that the data centers remain 
in two locations but under a unified management team. 

Whatever the outcome of Kelso's IT projects, observers 
say conditions couldn't get much worse for a state which 
sells debt notes rated one notch above junk bonds. .Any 
successes Kelso can show could help California bargain for 
lower debt payments, says C^arol KelK; a vice president of 
government strategies with Meta Group. That's, of course, 
assuming Kelso gets to keep his job. -Robert McMillan 
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REMEMBER FLORIDA IN 2000? 

The outdated voting machines and 
disputed election results? The 
American Civil Liberties Union 
(ACLU) of Southern California 
does, and it has sued to block 
California's recall election slated 
for Oct. 7, until the state replaces its 
punched-card voting systems. 

On Aug. 20, a federal judge 
rejected the request. Though 
California is under a court order to 
modernize its voting systems by 
March 2004, the recall election 
takes precedence. Voters m\\ choose 
whether to recall Gov. Gray Davis, 
and if yes, then pick from a list of 
135 candidates to succeed him. 

The ACLU of Southern California 
won an appeal after arguing that 
the old methods would be unfair 
to voters in urban areas such as 
Los Angeles. On Sept. 15, a court 
said the election should wait until 
March, after new machines are 
installed. Even in places where 
new technology has replaced old. 
people are worried. Orange 




County officials, who installed a 
$26.1 million electronic voting 
system, say they'd like more time 
to train poll workers. They may rely 
on older ballots to do the job. 

In spite of this uncertainty, 
Doug Chapin, director of nonparti- 
san election reform website 
Electionline.org, says the recall 
balloting will offer a good test of 
some new systems before the 
2004 elections. Shasta County, for 
example, will be implementing 
touch screen voting for the first 
time this month. "The experience 
of counties like Shasta could 
provide a lot of lessons— good or 
bad. depending on the outcome— 
for other counties considering 
last-minute changes next year," 
Chapin says. -Stephanie Overby 
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On the West Nile VirusTrail 



IN SOUTHERN ONTARIO, West Nile virus 
trackers with the Hastings and Prince 
Edward counries" health unit have more than 
37,?,000 square miles to cover. Their job: 
look for dead birds that might harbor the 
p<itentially fatal mosquito-bom disease and 
check standing water for mosquitoes and 
larvae. TheTi warn the public aliout where 
the virus has been deteaed and urge people 
to take precautions, such as wearing pants 
and long sleeves and using insect repellent. 

Since April, the 1 7 inspectors of the West 
Nile virus surveillance program have been 
collecting data (date, time, GPS coordinates 
for field sites, information about birds. 



mosquitoes and larvae) using a PDA appli- 
cation designed for the task. Tlie applica- 
tion, Assur H&S (health and safety), is from 
Calgary, Alberta-based vendor Carmina 
Technologies, which specializes in pest con- 
trol and disease monitoring systems. It is 
designed for PDAs and has been easy for 
county inspeaors to use, says Glen Hudgin, 
the agency's director of public health inspec- 
tion. Users synclironize the PD.As with com- 
puters at the office to analyze data collected. 

Standalone software applications for 
PD,\s "arc fantastic. With an application 
like this, I imagine you could train some- 
body in an hour or less," says David Shiple, 




a Forrester Research analyst. 

West Nile threatens much of North 
America until the first hard frost occurs 
(usually October in Ontario). As of Aug. 
28, Canada confirmed nine West Nile cases, 
while the United States reported 1,482 
human cases in 34 states, with 24 deaths. 
Hudgin says the proactive approach helps 
contain the West Nile risk. "We're quite 
confident that the work we're doing |in the 
field] is helping to reduce the risk to the 
public," Hudgin says. -Nancy Weil 
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Dell Handles 125,000 

Transactions Per Hour With Oracle 

D^LL 



Dell counts on Oracle on Linux to handle 
customer orders every day. 

What do you run? 



ORAC 
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oracle.com/success/ dell 
or call 1.800.633.0759 



Copyright 0 2003, Oracle Corporalion, All nghis reserved. Oracle is b registered trademark of Oracle Corporation andior its affiliates, Other names may be trademarks of their respective owners. 
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It's Not Just What You Send, 

It's What You Store That Needs Encryption 

Despite evidence that stored data is more 

vulnerable than data in transit, companies still 

focus encryption efforts on data transmission. 



It's Time to Protect Stored Data 

A recent survey conducted by C/0 and PricewaterhouseCoopers found that the most 
common result of security breaches in the past 12 months was the compromise or loss 
of stored data, just ahead of applications and network availability. 

Stored data unavailable, compromised or lost 
E-mail and applications unavailable 
Network went down 

Financial losses 
Brand/reputation compromised 
Intellectual property theft 
Legal exposure 
Fraud 

Identity theft (client or employee information stolen) 
Loss of shareholder value 
Extortion 

It's Also Time to Make Encryption a Priority 

Only 30 percent of IT executives said their companies encrypt stored data, 
yet it's attacked most frequently. 

We've encrypted stored data mmBliHIHii 30% 
We secure transactions HHHBHHHH^HII^^^^^^^H 53% 

We data transit 54% 

SOURCE : "State of IT Security 2003." a worldwide study conducted by CIO and PricewaterhouseCoopers— 7.596 respondents 
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Best Practices 

Don't lose the key. If you store 
encrypted data and lose the digital 
encryption key, you cannot read that 
data. Depending on the form or 
encryption you choose, if you store 
data in an encrypted fashion and 
lose the digital encryption key or 
access passwords, you have no way 
of ever reading that data again. 
Make sure you have backup proce- 
dures and access permissions as 
part of your encryption strategy, 
including storing encryption keys 
and passwords in escrow with a 
secure third party. 

Pick and choose. Some stored 
information may warrant this 
additional level of security, such as 
R&D or sensitive customer records, 
but other data may not. Companies 
should frequently review the 
classification of data and informa- 
tion and determine which assets 
require encryption. 

Align your security policy with your 
company's business objectives. 

This will help you determine which 
data is critical to the business- 
requiring additional layers of 
security— and which is not. 
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AVAyA 



a higher plane 
of communication 



AS YOUR COMMUNICATION NETWORK gets more 

complicated — dare we say, converged? — you 
need to toughen your defense. Meet the complete 
security solution from Avaya. Our mantra: the 
pucks stop here. Count on Avaya Security 
Solutions to protect your entire network, no matter 


where you are on the path to IP telephony. We 
take a holistic approach to security with the multi- 
vendor expertise of Avaya Global Services. Our 
industry-certified consultants methodically assess 
all your communication devices, policies and 
vulnerabilities, inside and out (no sneak shots 


around the post). In the state of Avaya, our 
services, systems, applications and products 
assure that your converged network is secure by 
design. See why it's no contest when Avaya 
security Is minding your net at avaya.com/secure. 
Or call 866 -GO AVAYA today. 


IP Telephony | Contact Centers { Unified Communication | Services 



MINDING YOUR NET, 

your voice, data, even your converged network can he 

SAFE AND SECURE. 



C 2003. Avaya Inc. AH RightE Resetved. Vi^P 

Avaya lha Avaya logo, and atl trademarks identified by 9 or are ir:i:l?mar1(S of Avay<i inc find rr. i 
be ragislered m certain |unsdici>on&. All otfw trademarks are the r^'P'i'^y o' 'hfi- fi^r-pi^'fivn "wner ? 





A world of IT solutions. 

Whatever your world. 





Dell has a customized IT solution for your business, no matter what business you're in, or what size it is. 

From PowerEdge"' servers featuring Intel* Xeon" processors to network support products like PowerVault" Storage 
and PowerConnect" switches, Dell offers flexible, high-performance industry-standard technologies and software 
solutions that are just right for your particular business needs. And we'll help you every step along the way. Whether 
it's planning and design, testing and validation, systems management, or our award-winning 24 x 7 service and support, 
Dell will help you create an IT infrastructure that's easy to choose, deploy and manage. So make life easy on yourself 
and get a big advantage over your competition - with a unique IT solution from Dell. 



Dell Rated #1 in Intel-Based Server Satisfaction 

21 Out of 22 Consecutive Quarters 
Technology Business Research 
Corporate IT Buying Behavior and Customer Satisfaction Study 

First Quarter 2003 
-July 2003 



CbII:M-F 7a-atiS<t8a-5p,CT 

Pricing, spccitrtaiions. avaiiabilitv and teffns of offef may change without notice. Taxes and shipping charges extra, and vary and not sittiect to discounts. U S. Dell Small Business new purcl^ases only. Dell cannot be held responsible fof errors in typography 
or pJiotograpiiy 'This device has not been approved by the federal Communrcaiions Commission for use in a lesideniial environrrtent This device is not. and may not be. offered for sale or lease, or sold or leased for use in a residentral environment until the 
approval of the FCC has been obtained 'Sonnce may be provided by ttiird party Technician will be dispatched following phone-based troubleshooting. Subject to pans availability, geographical restrictions and tenns of ser\'ice contract Service timing dependent 
upon time of day call placed to Dell U S only ' DDR 333 memory runs at 320MH7 when used with BOQ^^H^ FSB processors. "T^orthly payment based on pre-rebate price tor 48-month 60 Days Same-As-Cash-QuickLoan with 46 payments at 9 99% interest rate 
Your interest rate and monthly payment may be same or higher, depending on your creditworthiness If you do not pay the balance within 60 days of the QuickLoan Commencement Date (which is five days after product ships), ii^terest will accrue during those 
first 60 days and a documentation fee may apply OFFER VAfl lES BY CREDITWORTHINESS OF CUSTOMER AS DETERMINED BY LENDER. Minimum tiansaction sae of S500 required Maximum aggregate financed amount lot the paperless acceptance not to exceed 
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FILE AND PRINT SERVERS 
From entry-level servers to robust rack-mountable solutions that fit existing infrastructures. 

NEW PowerEdge"' 650 Server 



NEW PowerEdge" 400SC Server 



Small Business Value Sarver 

• Intel' Celeron' Processor at 2GH; 

• Upgradable to Intel' Pentium' 4 Processor at 3.20GH2 
with BOOMHi Front Sirie Bus- 

• 12BMB 333MHz ECC DDR SDRAM |Up to 4GB| 
•40GB (7200 RPMIIDE Hard Drive 

• Upgradable to 240GB of Internal Hard Drive Storage 

• Embedded Intel" PRO Gigabit" NIC 

• 1-Yr 24x7 Dedicated Server Phone Tech Support 

• 1 -Yr Next Business Day Qn-Site Senrice' 

• Small Business Pricing 



Low-Cost Ganaral-Purposa lU Sarvar 

• Intel' Pentium' 4 Processor at 2.4aGHi 

• Upgradable to Intel' Pentium' 4 Processor at 3,06GH2 

• 128MB 266MHz ECC DDB SDRAM 

• Upgradable to 3GB of SDRAM 

• 206B 17200 flPM) IDE Hard Drive 

• Upgradable to 146GB of Internal Hard Drive Storage 

• ATA 100 IDE RAID Controller Available 

• Intel" PflO Gigabit" NIC 

• 3-Yr Next Business Day On-Site Service' 

• Small Business Pricing 



«399 



E-VALUE Coda: 18SW-S20903g 



$1199 



as low as $33/mo , 146 pmis ' I 
E-VALUE Coda: IIIS80-S2ll911g 



DATABASE AND WEB HOSTING SERVERS 

Application-specific servers that can meet most any challenge. 



PowerEdge" 2600 Server 



High-Perfonnanca Towai Sanar 

• Intel' Xeon" Processor at 2 80GHz 

• Dual Intel' Xeon" Processor Capable (Up to 3.06GHz| 

• 512MB 266MHz ECC DDR SDRAM 

• Upgradable to 6GB of SDRAM 

• 36GB (10K RPMI Ultr3320 SCSI Hot-Swap Hard Drive 

• Active ID Bezel for Manageability 

• 3-Yr Next Business Day On-Site Service' 

• Small Business Pricing 

C^CQQ as lowas$43/mo.,(46pmts<l 
I ^413 E-VALUE Coda: 18Sn-S20915g 



NEW PowerEdge" 1750 Server 

1U High-Parlonnanca Rack Sarvar 

• Intel' Xeon" Processor at 2 40GHz 

• Dual Intef Xeon" Processor Capable (Up to 3.06GHzl 

• 256MB 266MHz ECC DDR SDRAM (Up to 8GB1 

• 36GB nOK RPMI Ultra320 SCSI Hot-Swap Hard Drive 

• Integrated Dual-Channel Ultra320 SCSI Controller 

• Active ID Front Bezel for Monitoring System Health 

• 3-Yr Next Business Day On-Site Service' 

• Small Business Pricing 



$1699 



as low as $46/mo . 146 pmis' l 
E-VALUE Coda: 18S«)-S2ll916g 



SERVICES 
Purchase 

• Dell offers a wide range of reliable, award-winning 
technology, all delivered from a single point of 
contact - and our expert sales associates are 
tfiere to help you find the technology that's right for 
your business. 

Installation - Starting at S199 

• Once you've selected the right technology. Dell can 
help you get it up and running quickly and cost- 
effectively with our custom on-site installation and 
configuration services. 

Training & Certification - Starting at S100 

• After installation, Dell can help turn your employees 
or IT staff into experts on your new technology 
through a variety of training and certification courses - 
helping increase your business' long-term productivity. 

Service & Support 

• The support doesn't end at the sale. Dell's award- 
winning service and support offerings help ensure 
that your new network remains up and running - 
with Web. phone or on-site service' and support 



' 4-WAY SERVERS 

Handle intense networking needs witfi ease. 

PowerEdge" 6600/6650 Servers 



Quad Processing Power in Rack-Mountable or 
Towat Fonii Factors 

• Up to Four Intel' Xeon" Processors at 2GHz 

• Up to 32GB DDR200 ECC SDRAM 

• Up to 1752GB Maximum Internal HDD Storage 

• Embedded Ultra SCSI Adaptec' lt60MB/s) Controller 

• Standard Hot-Swap Hard Drives, Hot-Swap Redundant Fans 
and Hot-Swap Redundant Power Supplies 

• 10 Hot-Plug PCI-X Slots 

$l«yiOO 25 towas$147/mo,(46pmts') 
starting at *<^«JH«I«I E-VALUE Coda: l8S80-S2D954g 



NETWORK SWITCHES 
Design a powerful network by enhancing it 
with scalable, high-performance switches. 

PowerConnect" 2000/3000/5000 Switches 

PawafConaact" 2000 Series - Starting at 

• Affordable, Easy-to-lnslall Unmanaged Switches 

PowerConnect" 3000* Series - Starting at '549 

• Stackable. Enterprise-Class Managed Switches 

• Advanced Management via Browser or Industry- Standard CL! 

PowerConnect* SOOO* Series - Starting at 

• High-Performance, All-Gigabit Managed Swilclies 

• Laver-3 Aware Class of Sen/ice Prioritization 

Next Business Day Advanced Exchange Service" Included 



STORAGE OPTIONS 
Enhance your server capabilities. 

Dell PowerVaulf^N NAS^ 



Optimized File Storege Across the LAN 

• Intel* Celeron' Processor at 1 .70GHz 

• Upgradable to Inter Pentium^ 4 Processor at 2.GOGH2 

• 4x40GB (160GBI IDE Hard Drives 

• Up to 1 Terabyte of Internal Storage Capacity 

• Microsoft' Windows' Powered Network Attached Storage 



$1799 



as low as $49,^mo.. (46 pmts") 
E-VALUE Code: 1KMI-S2l»17n 



Dell I EMC 



If you have more than 300GB of storage, visit www.dell.cofn/storage4niyiiiz 

for low prices on Dell/EMC storage arrays 



Solutions that fit. Easy as 



D0LL 



Clickwww.dell.com/bizsolutions Call 1-800-678-1626 



$25,000. If your order exceeds $25K, a Dell Rr^ancial Sen/ices rep wil) contact you to process your documentation. Taxes, fees and shipping charges are extra and may vary Not valid on past orders or financing QuiclcLoan arranged 
by CIT Bank to Small Business customefs with approved credit "This term indicates compliance with IEEE standard B0?3ab for Gigabit Ethernet, and does not connote actual opetaimg speed ot IGB/sec For high-speed 
transmission, connection lo a Gigabit Einernet sender and networV infrastructure is required ^Technician, replacement part or unit |deper>din{| on seMce contract) will be dispatched, if necessary, following phone-based 
troubleshooting in advance ot receipt of returned defective unit Service may be provid^ by third-party provider. Subject to parts availabditv, geographical restrictions and terms of service contract Sen^ice timtng dependent upon 
time of day call placed to Dell DetBctrv'e unit must be returned. Replacements may be tefurbislied. U S. onfy Oell, the stylized E logo. E-Value. PowerEdge, PowefConnecl and PowerVault are trademarks of Dell Inc Intel. Intel Instde, 
the Intel Inside logo, Intel Xeon, the Intel Xeon logo , Pentium and Celeron are trademarks or registered trademarks of Intel Corporation or its subsidiaries m the United States and other countries, O2003 Dell Inc. All nghts reserved 
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VENDOR RELATIONSHIPS 

Vendor 
Consolidation, 
A Look Back 

MERGERS AND THEIR CONSEQUENCES have again been very 
much on CIOs' minds with PeopleSoft's recent acquisition of J.D. 
Edwards and Oracle's threatened takeover of PeopleSoft. The 
familiar refrain — what will become of the end users? 

It's a scenario with ample precedent. Back in the days when 
John Kennedy lived in the White House, eight vendors dominated 
the U.S. mainframe market. IBM's share reached as high as 
60 percent. The rest was divided among the so-called Seven 
Dwarfs: Burroughs, Control Data, GE, Honeywell, NCR, RCA 
and Univac. A few years latei; Honeywell acquired GE's computer 
division and Univac swallowed RCA's leaving a gaggle of IBM- 
wannabees known by the acronym BUNCH. As consolidations 
winnowed the bunch, each stage left another customer group bereft 
of its chosen computer architeaure and struggling to adapt. 

The lessons from data centers past are both encouraging and dis- 
concerting. Veterans of the mainframe market shakeout say the 
vendors did try to support their customers' migrations to new sys- 
tems. On the other hand, they and observers warn that 2003 is not 
1963, or even 1983. Today's technology markets are more com- 
petitive, and vendor-user relations are not as genteel. 

The bottom line: CIOs should expect some important bumps as 
mature enterprise software markets such as ERP move toward 
consolidation. The mainframe veterans certainly saw their share. 



When the mainframe market con- 
solidated, CIOs of the 1970s and 
1980s suffered sleepless nights. 
And yet, IT veterans say, it was an 
easier time for technology migra- 
tions compared with today's world. 



"There were lots of sleepless nights," recalls Paul Strassmann, a 
former CIO at Xerox, which itself briefly entered the mainframe 
business. Strassmann, who also served as CIO at the Defense 
Department, says he was hired by Xerox in about 1970 "to get rid 
of our IBM mainframes and install our own Xerox mainframes." 
He did. Xerox ran more than 100 of the systems, he says, but 
then in 1974, Xerox sold its mainframe business to Honeywell. 

Honeywell worked hard for several years trying to make the 
marriage work, but eventually there weren't enough spare circuit 
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boards for the Xerox machines, and field service engineers had to 
develop workarounds, Strassmann says. "Our maintenance costs 
went up and up," he adds. So, Xerox migrated to Honeywell iron. 

Then, in the 1980s, Strassmann 's data centers took another blow 
when Honeywell sold what was left of its mainframe operations to 
a "maintenance only" unit of Wang Laboratories. The Wang engi- 
neers could fix things, says Strassmann, but if you wanted major 
parts or additional equipment, you had to search the used market. 
"It was as if they cut off both arms at the elbow," he says. 

Despite Strassmann's experiences, though, John Phelps, a vice 
president at Gartner and himself a 30-year IBM veteran, says most 
of the mainframe transitions of years past were heavily supported 
by the surviving vendor. "Usually the vendors developed exten- 
sive conversion programs," he says, referring to both software 
programs and support teams. "It wasn't a large universe of cus- 
tomers, so vendors didn't want to alienate them," he adds. 

George Gray, a systems programmer for the Georgia Depart- 
ment of Administrative Services, says that the 1986 Sperry/Univac 
takeover of Burroughs "was ver>' scar>' at the time, but they man- 
aged to keep delivering the product, especially the software." And 
today Gray still runs what he terms the great-grandchild of his 
1986 Burroughs machine, called ClearPath Plus from Unisys 
(formed from the mergers of Sperry and Univac and Burroughs). 
Support levels did deteriorate, though — something Gray attributes 
to industry changes rather than to the merger. 

Outsourcing expert Robert E. Zahlec, a partner at Wjishington 
law firm ShawPittman, says the mainframe market shakeout 
occurred in an emerging market. 

"The Seven Dwarfs weren't stable economically," Zahler says, 
whereas today's mergers occur in a mature market. Thus, he pre- 
dicts that J.D. Edwards will disappear within PeopleSoft, whose 
own products may fade if it is taken over. "The produrt lines will 
evolve, and the outlying functions will gradually disappear," he 
says. And the users will have to learn to like it. -Alan R. Earls 
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How Content Management 
Technologies Can Deliver 



Bottom-Line Results 
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Reduce Costs, Improve Productivity and Increase Efficiency 
Through Enterprise Content Management 

Content management technologies have moved beyond their traditional mission to 
capture and organize data for better access and retrieval. The real benefits of today's 
content management strategies are reduced costs, improved productivity and collabo- 
rative business processes. With the ever-present mandate to improve ROI and lower 
Total Cost of Ownership (TCO) for IT investments, content management is a win/win for 
both IT and your organization. 

Consider some of your own core business functions such as accounting, human 
resources, and customer support — chances are, you are still using a combination of 
paper documents, email, manual searches, and other time-intensive processes. These 
inefficiencies result in overhead expenses, rework and mistakes — but the good news 
is that today's content management technologies can make significant operational 
improvements and provide tangible, bottom-line results. 

Automated Processes Integral to Business Management 

Large or small, public or private, anywhere in the world... virtually all organizations are 
driven on some level by the day-to-day processes that support business operations. 
Today's employees know that their organization depends on their ability to collect, 
manage and deliver the right information to the right person at the right time. That's why 
many organizations are implementing automated, integrated content management 
solutions. With integrated content management, you can achieve gains in three critical 
areas: 

■ Productivity - Any business function can become more efficient when the data it 
needs to perform that function is readily accessible and usable. For example, with 
integrated content management, an accounting staff can better track payables and 
speed up payment to vendors - ultimately improving the company's credit rating and 
lowering the overall cost of credit. 

■ Efficiency - With integrated content management, your employees will be able to 
seamlessly access, retrieve and process electronic data, versus spending time on 
manual searches or other time-consuming, outdated processes. 

■ Compliance - In most organizations, certain types of data must be retained for many 
years for auditing and tax purposes. Conversion of paper documents to electronic 
formats significantly reduces the amount of storage space required for documents - 
therefore reducing or eliminating your costs for off-site archival storage. And, you 
can readily access the documents you need in the event of an audit or other 
enforcement action, speeding resolution. 

Selecting a Content Management Solution for Your Accounting Function 

To understand the benefits that can accrue from an integrated content management 
solution, consider the accounts payables (AP) function - a universal business operation. 



An integrated content 
management solution for 
accounting should include: 

■ Electronic repository of all 
accounting data, with 
Web-based access to that data 

■ Workflow, or business 
process capabilities to 
streamline operations 

■ Integation with other 
software applications 

■ Secure, accessible storage 
of electronic data for 
cost-effective storage and 
compliance requirements 



An integrated content management solution for AP should 
include five core capabilities: 

■ An electronic repository of all source documents - Your 
organization will speed up processing, minimize manual 
searches and create a valuable repository of data by 
converting paper documents into an electronic format. This 
can be done via scanning technologies that should be part 
of your overall content management solution. Scanning also 
minimizes the space and overhead associated with files and 
boxes of paper documents. 

■ Browser-based access to accounting data - A Web 

interface to your electronic data means your staff can 
process documents no matter where the data or the staff 
person resides. As a result, your staff can be productive, 
regardless of location, time zones and other constraints 
associated with traditional accounting processes. The AP 
operations can be done with keystrokes and mouse clicks, 
not manual searches, faxes, and multiple hardcopies. 

■ Workflow, or business process automation capabilities - 

Automating specific processes in accordance with your 
organization's business rules can dramatically improve 
efficiency. Once a particular step in a process is 
completed, say matching an invoice to the purchase order in 
the accounts payables process, the document(s) are 
automatically forwarded to the appropriate person for the 
next stop in the process. 

■ Integration with existing accounting applications - The 

content management solution you select needs to feature 
open architecture and software development kits to allow 
for easy integration with your existing applications. This 
type of integration can enable users to access documents 
directly from within the accounting application. 

■ Data protection - Finally, no integrated content manage- 
ment solution would be complete without secure, accessible 
storage and data protection. Look for a data storage and 
management component that is flexible enough to let you 
choose the storage media that is best for your organization 
- including optical, WORM, Tape, DVD and CD, as well as 
newer disk-based options. 

In addition to the above capabilities, be sure to select a content 
management solution that is backed by a company with the 
experience, resources and support that you need. 
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Processes in Thousands of Organizations Worldwide 

As you evaluate integrated content management solutions for 
your organization, be sure to consider LEGATO Systems, Inc. 
LEGATO Systems is a global provider of data management 
solutions that drive operational efficiency and business continu- 
ity. Our integrated, automated content management solutions 
have been implemented in thousands of organizations around 
the world in many industries - including finance, healthcare, 
telecommunications, manufacturing and education. 

ApplicationXtender®, the core of LEGATO's content manage- 
ment solution, takes a unified approach to data collection, 
generation, management and delivery. It enables access 
through a universal interface by intelligently indexing, organiz- 
ing and storing data from across the enterprise. Other key 
components of LEGATO's content suite include WebXtender®, 
ERMXtender* and WorkflowXtender^. 

The newest addition to the ApplicationXtender family is 
WorkflowXtender® for AP Designed to be largely an "off the 
shelf" application, WorkflowXtender for AP helps maximize the 
efficiency and productivity of the accounting process. It's easy 
to install and configure and provides a complete solution that 
captures invoices and manages the review and approval activi- 
ties through to payment. LEGATO also offers customized 
workflow solutions for accounts payables. 

All Xtender products are built on a solid foundation that 
includes comprehensive data storage management through 
LEGATO's award-winning DiskXtenders product, which provides 
virtually infinite storage capacity for content. In addition, 
DiskXtender allows organizations to choose the storage media 
that best meets their access, retention and cost requirements, 
including NAS, Optical, WORM, Tape, DVD and CD, as well as 
the latest ATA disk-based devices. 

The ApplicationXtender suite provides comprehensive capture 
capabilities for your enterprise data, including imaging, 
electronic file support, faxes and computer output reports for 
both traditional COLD (text-based reports) as well as advanced 
printstreams (AFP, Metacode, PCL and PDF). The suite will also 
capture index information from the various formats, and store 
the indexes in a centrally available repository- which also 
creates a virtual repository for all content. 

ApplicationXtender supports a comprehensive content manage- 
ment strategy, and can help your organization achieve signifi- 
cant cost savings and productivity gains for an outstanding ROI. 

For more information about ApplicationXtender 
for Accounting and LEGATO Systems, 
visit www.legato.com/solutions/accountlng 
or call 888-853-4286. 



The benefits of applying content management 
technologies to your organization include: 

■ Reduced costs 

■ Improved productivity through fewer manual processes 

■ More efficient use of document and other content that 
drives day-to-day operations 
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I can't pull all-nighters every night. 



Thing is, our backup and recovery system has to. 



It can't rest. 



Not even for a second. 



Not if I hope to get some myself. 




Make sure your data's always safe and you'll save yourself a lot of worry. And work. One way is with EchoView"". A potent, new data 
protection appliance that continually captures and journals data as soon as it's written, for nonstop protection. And EchoView™ provide: 
rapid recovery to any point in time, to keep business humming. So while your systems may be disrupted, your nights won't be 
Learn all the ways we can help you at vvww.savetheday.com. STORACETEK Save the Day.- 
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STORAGE SOLUTIONS: 

SAVE THIS EDITION 



While on the topic of stor- 
age, let me give you a 
piece of sound advice: 
hold onto tliis particular 
Strategic Directions edi- 
tion. Get extra copies if 
you have to, and lock 
some away in a safe 
place for later retrieval 
and reference. Whatever you do, don't 
let tliis issue tall into the desktop pile of 
to-be-reads that never gets read. 

Because of all the key topics we 
could be exploring (and, hey, in the 
Strategic Directions series, they're all 
key topics), none is any more front- 
and-center and of-the-moment than 
data storage and management. 

Excuse me. Make that "Data and 



READER FORUM 

To the Editor: 

This issue on Security talies home the 
trophy. In fact, you could do all four 
Issues this year on the changing face of 
security in technology —the corporate 
environment includes all forms of tech 
innovation from PDA and tablet PC to 
cell phone hybrid with internet access. 
I'm particularly Interested in the vul- 
nerabilities of satellite connections and 
extended range wi-fl (from 7 miles to 30 
miles). 

It's a winner. Congrats. I'm using it 
rather than Just reading it with interest 
as with most other CIO issues. 
Dick Bouslough 
ISDir 

Forest Home Inc. 



BY TOM FIELD 

Storage Solutions" because, really, 
that's what we're here to discuss: new 
ways to tackle the ever-growing prob- 
lem of storing and securing all this vital 
data we collect. 

At a time when CIO Magazine's 
annual "State of the CIO" survey 
reveals integration, cost-reduction, 
alignment and security as the top four 
priorities challenging IT leaders, stor- 
age cuts to the heart of each of them. 
In this age of electronic commerce, 
data is the coin of the realm. Integrat- 
ing and securing this data in the most 
cost-efficient, business-driven manner 
possible — that's the task entrusted to 
IT leaders. And it's the mission of this 



To the Editor: 

Just catching up on my reading and 
caught your article on Outsourcing in 
the Strategic Directions series in the 
June 15 CIO magazine. The tips in the 
article are right in line with my thinking 
and our experience managing a S1 bil- 
lion outsourcing deal with Unisys Corp. 
as our partner. Particularly liked the 
line about outsourcing being an 
engagement - "...for It to succeed then 
parties on both sides of the deal have to 
remain fully engaged". 

Keep up the good work! 
Pat Schambach 

Assistant Administrator and CIO 
Transportation Security Administration 
U.S. Department of Homeland Security 



critical Strategic Directions edition to 
offer new strategies and solutions on 
such core topics as: 

■ Taking stock of information assets; 

■ Maximizing data investment; 

■ Dealing with unstructured data; 

■ Storage management technologies 
and techniciues; 

■ The ROI of data management. 

By no means is this Stratcffic Direc- 
tions edition the last word on storage 
management, but I'd like to think it 
fiirthers the conversation greatly. 

About Strategic Directions: As 
you know. Strategic Directions is the 
ongoing series of CIO Magazine sup- 
plements, produced by CIO's Cus- 
tom Publishing group, focusing on 
the key business-critical technologies 
and solutions of the day. Through 
research, analysis, case studies and 
vendor profiles. Strategic Directions 
provides an executive-level primer to 
the hot topics on the minds of senior 
IT and business leaders. 

Please let us know what you 
think — about Stratejjic Directions in 
general, this edition in particular, and 
ideas you'd like us to tackle in future 
editions. Got any storage manage- 
ment best-practices you'd like to 
share with other IT/business leaders? 
Send them to me; I'll pass them 
along in our next issue. 

Thanks for reading Stratejfic 
Directions. And thanks in advance for 
writing in w ith your feedback. 

Tom Field 

Director of Content Development 
CXO Media Custom Publishing 
Tfield@cxo.com 
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INFORMATION: 

GEniNG ALL YOU CAN FROM 
YOUR MOST IMPORTANT ASSET 



Extracting more value from 
existing resources, in partic- 
ular data and storage assets, 
is a top-of-mind challenge 
for CIOs," says Guido Sac- 
chi, chief information officer 
of credit card provider 
CompuCrcdit. 
To make it happen, you 
have to pull more value 
from your existing IT infrastructure and 
stretch legacy technologies and applica- 
tions to fit new demands. 

"The first step for IT departments 



What will it take? Here's the short list: 
■ OWN YOUR STRATEGY AND YOUR 
ARCHITECTURE. It's critical for CIOs to 
demonstrate leadership so that precious 
budget dollars are not spent in unneces- 
sary investments, says Sacchi. "Engage 
vendors in implementing an effective 
architectural design driven by the com- 
pany's business model and demand for 
informational assets. CIOs should 
implement what they have designed 
and be the owners of critical business 
knowledge, as opposed to abdicating 
this responsibility to vendors." 



"EXTRACTING MORE VALUE 

FROM EXISTING RESOURCES, IN 



PARTICULAR DATA AND STORAGE 

ASSETS , IS A TOP-OF-MIND 

CHALLENGE FOR CIOs " 



should be to devise a clear strategy for 
informational assets, focused on archi- 
tecture," Sacchi says. "Architectural 
design is the key to unlocking value, 
and it helps the organization define 
where true business value resides and 
what can be considered a 'utility'." 



■ APPLY ASSET MANAGEMENT PRINCIPLES. 

"It's striking that many people talk 
about data as an asset yet forget to 
apply fijndamental asset management 
principles," says Sacchi. For example, 
one of the main tasks for IT depart- 
ments should be to understand the 



criticality of informational assets. This 
approach has inspired a deep under- 
standing of data criticality at Compu- 
Crcdit and has led to more than 
$500,000 worth of freed-up capacit)' 
in just the first six months of the new 
strateg\''s execution. As a result, Com- 
puCredit completed an acquisition 
without additional capital investments 
in storage resources. 

■ KEEP IN MIND DATA, STORAGE AND BUSI- 
NESS CONTINUITY POLICIES. "Every 
organization should have at least min- 
imal policies relating to retention and 
expiration of files on online, near-line 
and offline storage systems," explains 
Hernan Alvarez, vice president of 
infrastructure at the mobile-media 
company Mobliss, Inc. "Nearly every 
element should be included." Impor- 
tant ones include data lifecycle and 
recovery priority. The data manage- 
ment plan needs to be tightly inte- 
grated with any disaster recovery plan. 
As the business grows, the data man- 
agement plan will change, and disas- 
ter recovery needs to follow. If the 
two are out of sync, mean time to 
recovery will be greater than the busi- 
ness can withstand without unaccept- 
able cost, and data loss may occur. 
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"THE AMOUNT OF UNSTRUCTURED 
DATA IN ORGANIZATIONS IS NOW SIG- 
NIFICANTLY LARGER THAN THE 

AMOUNT OF STRUCTURED DATA." 

—BILL RUH, SR. VP, PROFESSIONAL SERVICES, SOFTWARE AG 



■ CONSOLIDATE INFORMATION RESOURCES. 

Decision makers can't get an enterprise- 
wide \'iew of tlie business if \ital infor- 
mation is scattered and difficult to 
obtain. Sometimes consolidation means 
integrating physical resources — data, 
applications — and revamping business 
processes. Sometimes it means re-archi- 
tecting infrastructure. Sometimes it 
means \irtualization. For many organi- 
zations, consolidation means upping 
the ante when it comes to managing 
data, which must be synchronized, 
transformed and integrated from mul- 
tiple systems. Such integrated data may 
reside in a \ irtual database, a very large 
centralized database or a distributed, 
networked system based on Web serv- 
ices standards like XML (extensible 
markup language). 

■ INVEST IN STRUCTURED AND UNSTRUC- 
TURED DATA MANAGEMENT. Data man- 
agement investments can boost produc- 
tivitN', make customer-satisfaction work 
more valuable and efficient, and insti- 
tute a single, topside \iew of die busi- 
ness. The challenge: keeping databases 
manageable as they grow to petabyte - 
plus sizes while responding to a push for 
zero-latenq' business processes as well. 
It can be accomplished with increasing- 
ly sophisticated database design and 
management tools, as well as ubiquitous 
standards and faster interconnections 
that can move data quickly among a 
multitude of legacy systems. Getting the 
most out of all corporate resources also 
means finding more fruitful ways to 
exploit the knowledge contained in the 
vast amounts of unstructured data (doc- 
uments, for example) that every organ- 
ization produces. IT has to boost end 
users' ability to access that data — 
through portals, which serve as a stan- 
dard interface that may be centrally 
managed, and new kinds of search capa- 
bilities. Of course, all this data must be 
stored efficiendy and safely even as data 



volumes continue to explode. Storage 
networking, consolidation and resource 
management solutions that exploit open 
standards to ease administrative costs 
and infrastructure complexity are 
among the answers many organizations 
are exploring. 

■ DON'T FORGET ABOUT SECURITY. 

"Often, a database is secured very well, 
but an extract or backup copy has very 
little security," notes Bob Venable, 
manager of enterprise systems at Blue 
Cross and Blue Shield of Tennessee. 
"We need to keep up, so we need secu- 
rity' that follows data and ways to iden- 
tify' what's inside a file." 

■ MAKE IT A UTILITY. The ability to fine- 
tune IT resources ui immediate response 
to changing business conditions can 
lower costs and save rime. The idea is to 
model the corporate IT fijnction after a 
utility': services are delivered transparent- 
ly, without interruption, so end users can 
tbcus on the business task at hand rather 
than the twists and turns of technology. 
Utility computing empowers IT depart- 
ments to oiler usage-based chargebacks. 
Different user needs are met with vary- 
ing levels of service and availability that 
can be formalized with service-level 
agreements. The resulting accountabili- 
ty means that IT can more efficiently 
allocate assets and control costs, track 
changing u.ser needs with greater preci- 
sion, and fashion and exploit a more flex- 
ible infrastructure with better-planned 
hardware and soft\varc deployments. It 



can also align itself more closely with the 
goals of indi\idual business units and the 
company overall. 

■ REDUCE THE COSTS OF TECHNOLOGY 
OWNERSHIP. As more information tech- 
nologies become commoditized, it's 
critical to distinguish between IT activ- 
ities that are a necessary cost of doing 
business and those that can induce 
strategic leverage. "Remember to count 
in problem diagnosis and resolution," 
says Venable. "Finding a problem can 
take a lot of time and will be put off by 
busy people, resulting in downtime 
that's possibly longer and more costiy 
than paying to avoid the problem on 
the front end." Ways to trim the costs 
of nonstratcgic technologies include: 

• Componentization. Breaking up 
enterprise application suites into 
smaller, more easily digestible pieces 
that are implemented gradually in 
stages can generate a more granular 
return on investment (ROI). 

• Standardization. Open standards in 
data management and storage net- 
working can ease the struggle to inte- 
grate data and applications, and 
transport data between incompatible 
platforms. 

• Outsourcing. Non-core business 
ftmctions, such as payroll or purchas- 
ing non-production goods, can be 
handed off to specialists who do it for 
less than you can. 

• Bundling services. Negotiating serv- 
ice contracts as part of other purchas- 
es can save you, well, a bundle. SD 
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DATA MANAGEMENT 

IN A ZERO-LATENCY WORLD 



The value of the topside per- 
spective — the famous 360- 
degree view of the customer, 
the enterprise-wide view of 
the business — is undisputed. 
But generally, a topside view 
requires lots of data from 
many sources, and putting it 
all together is hindered by a lack of stan- 
dards and databases designed for single- 
shot operational Rmctions. Meanwhile, 
mixed-workload environments diat com- 
bine operational as well as analytic and 
decision -support fimctions strain legacy 
systems diat few can afford to abandon. 

Thus, two issues rise to the fore in 
data management: integration and 
scalability. 

Integration is the merging, cleans- 
ing and standardization of data and/or 
the integration of data silos. This is 
part of a larger movement toward 
enterprise integration that will be 
implemented with several kinds of 
solutions. According to the research 
firm Gartner, enterprise integration 
now consumes about 35 percent of 
total IT spending, as solutions move 
toward what Gartner calls the "service- 
oriented architecture" — IT infrastruc- 
ture functionality exposed as services 
accessed through well-documented 
interfaces, and business data and logic 
shared among multiple applications, 
enabling reuse of services and relieving 
developers of the need to handle back- 
end implementation minutiae. 

Scalability means ensuring that hard- 
ware, software and networks can reliably 
and efficiently deal with increasing 
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amounts of data and quickly evolving 
business demands. Developments in hard- 
ware are making it ea.sier to scale databas- 
es to the burgeoning needs of end users. 
Commodity s)'stems arrayed in a rack of 
"blades" can be amassed by the tens, or 
by die thousands, rivaling the power of 
symmetric multiprocessors but at less cost. 
And ncr\\ orkcd storage — notably storage 
area networks, with or without links to 
net^vork attached storage — makes possi- 
ble the centralized management of stored 
data independent of the systems and 
applications that access them. 

"Most database environments 
will grow way in excess of what any- 
one thought they would at the time 
of original design and purchase," says 
Bob Venable, manager of enterprise 
systems at Blue Cross and Blue Shield 
of Tennessee. "When it comes to scal- 
ability, think in terms of total edge- 
to-edge performance, from the enter 
key on end-user PCs to Ethernet 
communications lines to servers to 
disk. Remember, it's about true end- 
to-end performance." 

ITS ABOUT THE BUSINESS 

Driving data integratic)n is a mounting 
need to deliver unto decision makers the 
best possible information to do their jobs. 

"No data is standalone anymore," 
Venable says. "Almost everyone has over- 
lapping business prcKesscs that share data. 
Avoiding data duplication and accidental 
old data copy utilization is important." 

This means bringing together data 
from multiple, often incompatible appli- 
cations, legacy systems, enterprise resource 



planning (ERP) systems, flat files and 
more. Gartner estimates that migrating 
legacy data sources can eat up more than 
20 times the effort and resources required 
to deploy an ERP application. 

Data integration can be about 
some or all of these: 

■ Extract, transform and load (ETL) 
functions that pull information from 
databases 

■ Enterprise application integration 
(EAI) tools that allow applications to 
interact and pool data across platform 
environments 

■ Web services that permit one app to 
extract and manipulate data from 
another. 

OOING THE DIRTY WOBK 

Key to data integration is clean, usable 
data. The Data Warehousing Institute 
estimates that poor data quality costs 
U.S. businesses more than $600 bil- 
lion a year in printing, postage and 
staff overhead, among other expenses. 
Analysts at Gartner expect that over 
the next three years, at least 50 per- 
cent of data warehouse projects will 
fail to achieve their desired results due 
to data quality problems. 

Data cleansing tools, which integrate 
with ERP, CRM and other business intel- 
ligence solutions, clean up mailing lists or 
customer databases by searching for and 
correcting duplicate or incorrect address- 
es, for instance, or checking for mis- 
sf'jcllings or spelling variations. They can 
identify miscategorized data and apply 
customizable rules to ensure that the data 
entered is appropriate. 




Bob was 
drowning in 
email compliance 
issues. 




Now he's 
breathing 
easier. 



Thanks to LEGATO, he can do his real job. 

You need an efficient way to manage risk. LEGflTO's EnfioilXtender® suite 
simplifies email compliance. It captures, organizes, archives and provides 
immediate access to email and instant messages. So you can keep your 
head above v/ater v/hen it comes to compliance issues. Problem Solved. 

For more information, visit www.legoto.com or coll 1-888-853-4286. 

a LEGATO 



LEGATO, the LEGATO logo and EmailXtender are registered trademarks of LEGATO Systems, Inc. 
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ETL TODAY 

From their beginnings extracting rela- 
tional data, transtbrming it into a standard 
format and loading it into a data ware- 
house, ETL tools have evolved into 
instruments of data integration, pulling 
data from operational systems and all 
manner of applications. To combat such 
challenges as oven\ helming data volumes, 
p(X)r data qualit\', incompatible metadata 
management schemes and slow data 
transformation rates, vendors like Ascen- 
tial offer integration suites tliat take on not 
just ETL chores but also data profiling, 
metadata management and data qualit\'. 

ETL products can also help organ- 
izations do data integration on the tly, 
supporting multiple data formats along 
the way. Uniboard, a Canadian manu- 
facturer, expects to save $200,000 o\ er 
the next two years using XML Global 



Technologies' GoXML Transform, 
which maps between complex formats 
such as EDI, XI 2, HIPAA, SWIFT and 
XML without custom coding. 

UNTANGLING APPUCAT10N SPAGHETTI: 
ENTERPRISE APPUCATION INTEGRATION 

Too often, changing business conditions 
force organizations to enhance their IT 
infrastructures by means of standalone 
applications that were not designed to 
be integrated with any other systems. In 
order to share information throughout 
the enterprise, they topically turn to cus- 
tomized interfaces that allow for point- 
to-point integration — and in the process 
end up with application spaghetti, a tan- 
gle of interfaces. 

To untangle the mess, enterprise 
application integration ( EAI ) s\'stems use 
generic mechanisms and well-defined 



interlaces to connect existing applications 
and leverage multiple systems, generating a 
consolidated view of data. Because thq'Ve 
strategic initiatives, EAI topically involves 
designing an enterprise-wide framework 
that incorporates process definitions and 
business process reengineering and that 
embraces existing and ftiture systems. 

northAmcrican Logistics (nAL), 
for example, claims it saved more than 
$1.5 million over four years using Soft- 
ware AG's integration server, EntireX, 
to build a fijlly automated supply chain 
that processes all data exchanged with 
customers and partners via XML. 
Order-processing costs and expenses 
for the maintenance and development 
of its IT architecture were reduced as 
well. In fact, nAL estimates that for 
every $1 invested in EntireX, it 
achieved a net benefit of S5.49. 



CASE STIDT 




'S ENTERPRISE DATA ARCHITECTURE SOLVES APPLICATION INTEGRATION AN 
ABILITY, DRIVES SUCCESS 



Mglily-successftil direct marketer of branded credit 

cards and fee-based products, CompuCredit's competi- 
tive advantage is based on the sophistication of its ana- 
lytical techniques, risk and decisioning models— espe- 
cially the acquisition and servicing of credit card receiv- 
ables portfolios. 
Not surprisingly, the delivery of quality informa- 
tion — on-demand — is critical to the success of 
CompuCredit's 1,500 employees. So when 
CompuCredit's forv^ard-thinking CIO, Guldo SacchI, realized soon after join- 
ing the firm that CompuCredit's underlying IT infrastructure— particularly 
its data architecture — v^as in need of a serious overhaul, he took up the 
challenge and began the process of building an enterprise data architec- 
ture that would enable and sustain the firm's successful business model. 

XML GATEWAY: KEY TO SMOOTH FLOWING DATA 

After evaluating a number of design alternatives, says Sacchi, CompuCredit 
decided open standards, an XML architecture and an investment in web 
services would be the best way to achieve its goal of a truly supportive 
enterprise data architecture that solves the problem of enterprise appli- 
cation integration and interoperability. CompuCredit next choose Software 
AG as its technology partner for the project. 

"We shopped around, but only Software AG could pull together these 
three critical elements: open standards, an XML architecture and web 
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THE XML COMPANY 



services," he says, "^otlware AG had the mature tool sets, experience and 
vision we needed — and their ability to transfer knowledge has helped us to 
enhance our own In-house capabilities." 

With Software AG's help, CompuCredit has designed for itself an enter- 
prise data architecture capable of delivering the complex services needed 
to meet the challenges of its dynamic business 
environment. At the core of the flexible and scal- 
able new architecture is an XML Gateway. A 
doorway through which IT provides web services 
on-demand to users' desktops, the XML Gateway transparently provides 
access to CompuCredit's disparate data sources and applications. 

ROLLING OUT BOTTOM LINE RESULTS 

As the time nears for the rollout of the entire new enterprise data archi- 
tecture into production, the excitement, says Sacchi, is building. 

"IT is the foundation that sustains the growth strategy of the company," 
he says, " buying us the right to play at the deal table with an advantage 
over our competitors. And it allows us to acquire and manage portfolios 
more effectively— if I can deliver a one percent increase for our collec- 
tions, I'll add $1 million on the bottom line. That's big," adds Sacchi. 

Agreed. 

For more information contact Gerda Yearwood of Software AG, 
Inc. at 703-391-8295 or gerda.yearwoodiisoftwareagusa.com 



BSIRIIECIC DIRECTIONS 



CompuCredit's robust growth strategy requires on-demand delivery of quality 
information to more efficiently acquire and manage credit card portfolios. 

That's why CIO Guido Sacchi took on the challenge to reduce the time to 
service new portfolios from months to weeks with the XML Business Gateway. 

Imagine delivering to the business user's desktop a single view of information 
from disparate data sources, risk models and collections applications - 
right when they need it. 

Imagine transforming data locked into complex systems into real intelligence 
that propels the business forward. 

Imagine working with a partner who has over 30 years experience in data 
management including the early shaping and development of XML. 

Guido did. And now both he and CompuCredit are seeing imagination turn 
to reality. 



Discover the XML Effect. 
To learn more about Software AG 
and how the XML effect can help 
you unlock data assets, visit 
www.softwareagusa.com today. 
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Likewise, when equipment manu- 
facturer John Deere undertook a 
large-scale implementation of SAP's 
R/3 ERP solution, it also needed a 
way to interface — in real time — with a 
complicated legacy environment. Mer- 
cator's Inside Integrator did the trick, 
cutting the costs of legacy data con- 
version and other integration tasks by 
as much as 80 percent. 

DATA INTEGRATION WITH EAI 

EAI manages a host of tasks, proNiding 
user interaction mechanisms and Web 
server- or application server-hosted busi- 
ness logic that integrates apps, business 
processes and legacy systems. But its real 
focus is data integration. By connecting 
diverse databases in different locations, 
an EAI hub — which includes data trans- 
formation and messaging components — 
offers a consolidated view of business 



information. The hub transports data 
reliably and securely between databases 
in a consistent, repeatable way. 

Data manipulation is directed by an 
EAI solution's connectors (based on 
database triggers, event-driven, etc.), cre- 
ating a layer of abstraction that makes 
enhancements and maintenance easier. 

There are several implementation 
options for EAI: 

■ Buy it. Database-to-application capa- 
bilities are available from Software AG, 
IBM, Oracle, Sybase, Computer Asso- 
ciates, Microsoft and Sun Microsystems. 
EAI tools are sold by BEA Systems, 
Mercator, SccBeyond Technology, 
TIBCO, Vitria and webMethods. 

■ Build it (quickly). Perhaps better suit- 
ed to shorter-term projects focusing on 
data integration and targeting a few key 
applications; thus, the number of 
processes and techniques to be 



addressed is more manageable than 
with some large-scale projects. 

■ Leverage what you've jiot. Instead of 
investing in a new architecture, expand 
your application server functionality 
with solutions like IBM's WebSphere or 
BEA's WebLogic. 

COME TOGETHER: XML AND 
WEB SERVICES 

While Web services pretty much 
remain a pipedream, a lot of the parts 
needed to pull off production applica- 
tions are coming together. 

■ Vendors have heartily embraced XML, 
the key enabling standard. Relational 
database manufacturers are adding XML 
data-handling capabilities, and business 
giants like Wal-Mart are insisting on 
XML format for invoices and the like. 
While the bulk of enterprise data resides 
in file svstems rather than in relational 
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LONG & FOSTER FINDS CONSOLIDATION SAVINGS WITH GOMMVAULT 



The throughput we're getting vi/ith Commvault's Backup and 
Recovery software has been very impressive," says Chris 
Saben, networl( architect at real estate services provider, 
Long &, Foster. "More importantly, it's given us the comfort level we 
needed to go forward with our storage consolidation plans." 

As Saben sees it, confidence in consolidating is quickly lost if you 
can't restore rapidly. But since integrating Commvault's Backup and 
Recovery software for Microsoft Exchange into its newly installed 
23 terabyte SAN, Long & Foster's throughput per- 
formance has surged from 22 gigabytes an hour 
to 48 gigabytes an hour— reducing backup and 
restore time frames considerably and opening 
the door for storage consolidation. 

"Capturing our primary backups onto the SAN 
means we can stop using so many tapes," explains Saben. "By back- 
ing up to the SAN first, we're reducing our backup windows, allowing 
us to back up more servers in less amount of time. Then during the 
day, those backups are moved off the SAN into our large tape library 
for both long term and off-site storage." 

BIGGER DATABASES YIELD SMALLER COSTS 

Moreover, with a restore time of 48 gigabytes per hour. Long & Foster 
can now comfortably put larger Exchange databases on its servers 
and, for example, cut the number of Exchange servers needed to han- 
dle its mailboxes fronn ten to three. 

"It's the difference between spending $60,000 versus $200,000 on 
servers— that's a huge savings. The combination of Commvault's 



CommVault 
Systems 



OiNetix data management tools and our SAN enables us to realign our 
assets, to better meet our future needs without forcing us to make 
large expenditures in infrastructure," notes Saben. 

In addition to the big benefits of high throughput, CommVault's deci- 
sion to drive its solution off an SQL engine, says Saben, delivers a 
more robust database and its use of Windows drivers means Long &, 
Foster can adapt quickly to new backup technologies. 
Saben also credits CommVault Support with the ability to take 
"ownership' of a problem and anticipates deploy- 
ing QiNetix software to solve other data manage- 
ment issues. In fact. Long & Foster already have 
plans to use QiNetix DataMigrator software to 
make archived data rapidly accessible. 
"The combination of Commvault's QiNetix data 
management tools and our SAN enables us to realign our assets, to 
better meet our future needs without forcing us to make large expen- 
ditures in infrastructure," he adds. 

Long & Foster CIO Michael Koval Is also highly impressed with the 
benefits of CommVault's Backup and Recovery software. 

"Long & Foster provides the most robust IS support in the real 
estate business, and Commvault offers a substantial value proposi- 
tion, in terms of performance and cost, that helps Long &, Foster to 
maintain its lead in the industry," he says. 

For more information on Commvauit QiNetix enterprise data 
management soiutlons for Windows, UNIX, Linux and Netware 
platforms, visit www.commvault.com. 
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CONTENT AND 

DOCUMENT MANAGEMENT: 

DEUING WITH UNSTRUCTURED DATt 



Most of the information that 
drives the business still 
resides in non-relational 
applications. It's unstruc- 
tured data that cannot be 
transformed into intelli- 
gence using the same tools 
and techniques that have 
traditionally worked on structured data. 

And there's plenty of it too: At the 
end of 2001, more than 3 billion docu- 
ments could be accessed on the public 
Internet, a volume that, according to 



Content management solutions usu- 
ally accelerate information delivery 
cycles, permit multiple output chan- 
nels as well as information personal- 
ization and make content easier to 
locate and use. 

Among the capabilities CMSs can 
spread enterprise-wide: 

■ Furnish a common interface for all 
content types, structured, unstructured 
and image-based; 

■ Tag metadata via automated document 
categorization and summarization; 



THE VOLUME OF DOCUMENTS ACCESSED 

ON THE INTERNET IS DOUBLING EVERY 

EIGHT MONTHS. NO WONDER EMPLOYEES 

SPEND MORE TIME GATHERING 

INFORMATION THAN USING IT. 



databases, hybrid SQL/XML databases 
signal that business documents will no 
longer be beyond the reach of SQL- 
based querying and analysis. 

■ The two competing infrastructures — 
J2EE (available on application servers 
from IBM, Oracle, Sun Microsystems, 
Sybase and BEA) and Microsoft's 
.NET — can now frirnish the back-end 
conduits that connect Web services 
component architectures. 

■ New standards supporting a range 
of business processes across diverse 
systems and database environments 
are emerging: BPEL4WS (Business 
Process Executive Language for Web 
Services), WS-TX (Web Services 
Transactions) and WS-C (Web Ser- 
vices Coordination), as well as initia- 
tives by Web services standards bod- 
ies such as XML Digital Signatures 
and Securitv' Assertion Markup Lan- 
guage (SAML). 

■ Standards addressing Web services 
development will ease data integration 
challenges. Tlie ANSI SQL/XML stan- 
dard, for instance, transforms data 
between XML and SQL formats so that 
developers can write one XML application 
that will work across multiple relational 
databases widiout specialized knowledge 
of database vendors' XML extensions. 

Some worry that its overhead — text 
strings rather than binary — make XML 
transmissions too bulky and slow for 
real-time applications. Yet for the 85 
percent of apps that don't require real- 
time performance, XML will have an 
enormous impact as vendors and their 
customers develop XML-enabled data 
architectures. Consider Bosch Rcxroth, 
a maker of electric drives and controls 
and hydraulics. After it turned to Soft- 
ware AG's Tamino XML server to house 
all product information and integrate 
databases of images and technical tables, 
its cross-media publishing tasks — such as 
catalogs and brochures — became so 
much more efficient that the system 
paid for itself in 18 months. SD 



search engine Google, is doubling ever)' 
eight months. No wonder employees 
spend more time gathering information 
than using it. 

ENTERPRISE CONTENT MANAGEMENT 

The challenge: To enhance the qualit)' 
and longevity of information that 
resides in documents, yet keep the con- 
tent accurate, complete, up-to-date, 
easy to access and relevant. 

This can be accomplished using 
content management systems (CMS) 
that handle interactive formatting, 
content modification and distribu- 
tion. CMSs use standard, vendor-neu- 
tral techniques and separate produc- 
tion and distribution environments. 



■ Control document versioning, access 
and the ability to edit based on job 
function; 

■ Use document workflow rules to 
ensure accuracy; 

■ Establish time limits on how long 
information stays online and automati- 
cally update linked documents after 
changes. 

■ Consider the city of Munich, Germany, 
whose planners chose Software AG's 
Tamino XML ser\'er and a Web portal to 
cope with an out-of-control document 
volume. The server manages document 
metadata and controls portal commimi- 
cation. With the CMS, document pro- 
cessing times have been cut by between 
25 percent and 60 percent. SD 
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STORAGE MANAGEMENT: 

SOLUTIONS THAT CONSOLIDATE AND AUTOMATE 



According to research by 
the Enterprise Storage 
Group, a picture is worth 
about 18,000 words. All 
those bits and bytes are 
adding up fast too: the 
amount organizations are 
spending on data storage 
this year is over 100 per- 
cent more than they spent in 200 1 . 

Piling on more storage hardware— 
a tempting proposition as storage hard- 
ware costs drop dramatically — only 
makes storage infrastructures more com- 



plex and tougher to manage. Besides, 
storage utilization levels are so low diat 
more tiian half of typical host storage is 
unused. Buy more, waste more. 

Still, many enterprises rely on 
direct-attached storage that can't be 
shared and is tough to safeguard. For 
decentralized, heterogeneous IT envi- 
ronments, the costs and hassles — strug- 
gles to meet service levels, inconsistent 
data integrit)' and security, and rigid 
infrastructure — are becoming over- 
whelming in the face of demand for 
more data, more quickly, more often. 



The good news is that there's 
something a CIO can do about it: con- 
solidate storage resources, a task most 
effectively accomplished with net- 
worked storage. 

BEYOND COST CONTAINMENT 

For many, bringing rationality' to stor- 
age woes begins with a simplification 
and recentralization of storage 
resources. At a time when data storage 
is gobbling up more of the budget, 
consolidating storage can: 
■ Lower svstem administratim overhead. A 



CISE STBOT 



WITHOUT A STORAGE HICCUP AT MOBLISS 




i ' obliss, a leading mobile media company, is the worldiorse 

M behind the real-time voting and polling which is fast 
becoming a 'must have' for reality and sports shows. 
In 2002 the company expanded the size and scale of its 
offering linking it to TV for a real-time presence that 
prompts viewers to "vote" via text messaging. 
Not knowing how much trafTic It would receive, Mobliss' vice president of 
infrastructure, Hernan Alvarez, and his team looked for a storage solution 
that could ramp up quickly. 

"We knew success meant finding a ^st, reliable, 
scalable storage solution," says Alvarez. "We looked 
at a number of alternatives but nothing compared to 
EMC's CLARiiON CX200— it's simply the best entry- 
level array out there, period. And it was very, very 
easy to get up and running— we had a pair of databases talking to that sys- 
tem in minutes and it's been running without a hiccup since." 

IN PLACE UP GRADES 

One of the mayor CX200 draws, says Alvarez, is the data-in-place upgrades. 

"Not knoviflng how scalable we will need to be makes the in-place upgrades a 
key for us," he explains. "The ability to go from a CX200 to a CX400 or CX600 



EMC' 

where information lives 



with data-in- place, with very little interruption, is significant. Other vendors can 
add disk, but that alone does not get you the number of l/Bs per second you 
may need for a fast transactional application like real-time messaging." 

CONSOLE COMFORT AND MIXING DRIVES 

Alvarez is also pleased with CLARiiON's Navisphere management software, 
which he says is intuitive and requires little training. 
"Navisphere is a great management tool," says Alvarez. "We know what 
each Individual disk is doing and the ability to manage 
everything about the array from the console is 
extremely productive." 

Mobliss is also looking forward to leveraging ATA 
drive technology. 
"Mixing your high-speed fibre drives with lower 
speed, high-capacity ATA drives is very attractive; the price per megabyte 
is so low," notes Alvarez. "We have a lot of storage we don't need at break- 
neck speeds; but we want it to be there at acceptable speeds, with the 
same reliability as our high-speed data. The ability to intermix in a single 
product line is huge; we'll definitely be investing." 

For more Information, contact www.emc.com 
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Separating storage and server purchases Is the first step to faster, more secure backup. With networlted storage from 
EMC you can consolidate all your information, protect it better, and manage it more efficiently. And with solutions 
starting at $9,995, the EMC CLARIiON CX Series delivers world-ctass storage at a surprisingly affordable price. 

Take advantage of our special offers at «irww.EMC.coin/growthcoinpanies. Or call 1-8M-796-6369. 
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Find an authorized EMC Velocity Partner 
t^nKK 3' www.EMC.com/velocity 




CX Series starting at 
59.995 



EMCf EMC. and CLARilOH are registered trademarks and where infarmaticm lives is a trademark of EMC Corporation. C2003 EMC Corporation. All rights reserved. 
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simpler storage infrastructure can mean 
fewer data centers, less maintenance, 
trimmed staff costs and reduced licensing 
fccs. After Blue Cross and Blue Shield of 
Tennessee (BCBST) consolidated its data 
storage into a single networked environ- 
ment and implemented a storage area net- 
work (SAN), storage expenditures dropped 
by 60 percent and maintenance costs went 
down 70 percent. Add in space reduction, 
staff avoidance costs and productivity 
improvements, and the savings amount to 
between S 1 .5 million and $2 million a year. 
■ Boost storage utilization. Why are stor- 
age resources so poorly utilized? Mosdy 
because of inadequate connecti\it\'. Net- 
worked storage, which separates data 
storage from operational servers and 
makes it available in shared pools to end 
users via networks, can be dynamically 
allocated so that less storage space 



remains unused. Storage resources of 
varying types can be added quickly when 
and where needed — BCBST boosted its 
storage utilization by 40 {jercent. 

■ Generate economies of scalability. 
When combined with the right man- 
agement software, networked storage 
enables an organization's storage infra- 
structure to scale to the growth of data 
volumes. 

■ Make data management easier, even 
as the amount and complexity of data 
and its uses continue to grow. 

■ Improve security and business conti- 
nuity plans. As compared to labor- 
intensive, direct-attached storage, con- 
solidated storage solutions with 
automated backup and high-availabili- 
ty configurations can improve data 
safety and reliability while requiring 
less human intervention. 



■ Help align IT infrastructure with busi- 
ness strategy. Here's your chance to opti- 
mize a major chunk of IT infrastructure 
so it can meet current and ftiturc enter- 
prise demands — including legal require- 
ments imposed to maintain data privacy 
and management standards. 

■ Facilitate resource metering. Once 
storage gets provisioned from a central 
resource, usage can be monitored, 
measured — and billed. 

THE UTILITY OF IT ALL 

Many believe all this adds up to utilit)' 
computing — a rejiggering of core data 
center technologies in order to trans- 
form the components of IT infrastruc- 
ture, like storage, into services for which 
end users can be charged. 

But utility computing can't happen 
without storage management software. 
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In today's demanding times, market conditions are forcing com- 
panies to reconsider the ways in which they assign value to their 
information. Budgets are flat or declining and skilled human 
resources are scarce, while at the same time, more information 
is flowing through businesses (at 
annual growth rates of 50 to 70 per- ^ 
cent), and more laws and regulations are mandat 
ing how long information must be accessible. 



must be managed and can be stored on different levels and increasingly 
cost-efficient technologies. 

As a result, StorageTek is successful in the market because it is 
equipped to offer customers the best solution that addresses their criti- 
cal information management issues, while its 
competitors take a "one size fits all" approach by 
recommending the storage devices they have to 
sell instead of the technology that best address- 



StoraceTek 



That's why StorageTek, a total storage solutions expert, created its 
Information Lifecycle Management approach to helping customers more 
efficiently manage information from its creation to deletion. 

For StorageTek, Information Lifecycle Management is more than just 
words on paper. It's the way the company approaches data storage and 
solves information management issues with its customers based on two 
key issues: 

(1) What business decisions must the customers need to make about 
their information? 

(2) How does the value of information change over time? 

ONE SIZE DOES NOT FIT ALL 

StorageTek, one of a few companies that provides a full array of solutions 
to meet the data storage and archiving needs of businesses, understands 
that not all data is created equal and as data moves through its lifecycle it 



es customers' requirements. 

STORE, MANAGE, REPLICATE, INTEGRATE 

The building blocks of Information Lifecycle Management are store, man- 
age, replicate and integrate. These four elements help organize storage- 
related activities logically, and assure customers of a proper cost-benefit 
balance in managing storage. 

Not surprisingly, StorageTek's customers are embracing Information 
Lifecycle Management because it provides them with a solid foundation on 
which they can build their storage infrastructure as they grow. 

Through Information Lifecycle Management, StorageTek helps customers 
solve pressing strategic business issues, all while lowering the cost and 
improving the efficiency of their storage operations. 

For more information, visit www.storagetel(.com 



MSIItlECIC DIIECIIOIIS 



CIO ADVERTISING SUPPLEMENT 



BtTI IlfB STORIGE SDHrTIDMS | STOHIEE MftHIEEMEIIT 



leading IT infrastructure vendors like 
IBM, Hewlett-Packard, Veritas, Com- 
puter Associates and Sun Microsystems 
have committed to a vision of utility com- 
puting that embraces elements of storage 
management. As these efforts mature, 
several kinds of storage management 
capabilities will be integrated into diem: 

■ Storage provisiotmig, which dynami- 
cally deploys and optimizes hardware 
resources 

■ Storage virtnalization, which logical- 
ly abstracts storage from physical 
resources 

■ Storage policy-based management, 
which helps set performance and avail- 
abilit)' service levels 

U Storage resource management (SRM), 
which features billing, chargeback and 
capacity management. 

STORAGE VIRTUALIZATION 

As IT grapples witli burgeoning volumes 
of data and the creeping complcxit)' of 
storage environments, storage virtualiza- 
tion solutions can offer some relief 

Virtualization creates an abstrac- 
tion layer that separates the actual 
physical storage from the representa- 
tion of storage to the server operating 
system, portraying data stored in any 
number of media, devices and loca- 
tions as being located in one central- 
ized repository. This virtualized pool 
of enterprise data thus hides storage 
infrastructure complexities. Every- 
one— IT staffers as well as end users 
and their business applications — gets 
a single, logical view of all the data in 
the storage pool, allowing them to 
directly access the information they 
need wherever it is. 

Pooling 70 terabytes of arrayed 
storage, DataCorc Software's virtual- 
ization appliance has boosted Con- 
seco Finance Corp.'s storage utiliza- 
tion rates to 85 percent from 55 
percent, and the time required to 
provision storage for new applications 
has plummeted from four days to just 



an hour. The company has saved 
three times what the DataCore prod- 
uct cost, in part by being able to 
postpone the purchase of three addi- 
tional terabytes of storage. 

In addition to virtualization vendors 
like Legato (recently acquired by EMC 
Corp.) and DataCore, several major 
players are stepping into the ring, among 
them IBM, Cisco Systems, Hewlett- 
Packard and Sun Microsystems. 

STORAGE RESOURCES MANAGEMENT 

Before data can be migrated to a storage 
area netsvork (SAN ) or a networked area 
storage (NAS) environment, it needs to 
be categorized according to such vari- 
ables as file t)pe, access date, owner and 
business value. Widiout this kind of gran- 
ularity, conceiving cflcctive storage poli- 
cies — essential to succe.ssfi.il storage con- 
solidation projects — is tough to do. 

This type of categorization is per- 
formed by storage resource manage- 
ment (SRM) tools, which collect infor- 
mation about storage assets, place it in 
a central repository and, using analyti- 
cal tools, optimize storage assets and 
anticipate storage requirements. 

Even though SRM tools tend not 
to initiate actions, they generate signifi- 
cant ROI, since the alternative requires 
manually analyzing and categorizing 
enormous volumes of data. Many com- 
panies, including Veritas, IBM and 
Computer Associates, offer SRM prcxi- 
ucts. Integrated with storage policy and 
virtualization capabilities that allow them 
to automate service-level management, 
data path optimization, provisioning and 
so on, SRM tools will become key to 
infrastructure management. 

To get the most from SRM, look 
for products that deliver active, policy- 
based management that permit file- 
level automation across heterogeneous 
platforms and initiate corrective actions 
to help maintain storage asset availabil- 
ity. They should also manage data 
within mission-critical applications 



(such as Microsoft Exchange, SQL 
Server, Oracle) so you can get a con- 
solidated view of storage assets. 

"No organization should be with- 
out an SRM solution," says Nancv' Mar- 
rone, senior analyst at Enterprise Stor- 
age Group. "These tools provide 
information on how resources are being 
utilized, who the users are, and what 
tvpcs of files and data are being stored. 
SRM solutions can help organizations 
reclaim wasted space, more effectively 
utilize their resources and predict when 
they'll need additional capacity. The 
solutions aren't too expensive and help 
reduce total cost of ownership." 

SAN MANAGEMENT TOOLS 

Highly specialized SAN management 
tools supply the physical layer of 
storage management by identifying, con- 
figuring, alltKating and deploying storage 
assets in heterogeneous environments. 

EMC's Control Center, for instance, 
features array management, while McDa- 
ta's SANavigator is a fabric manager. 
Other products, such as Veritas' SAN- 
Point Control, EMC's VisualSAN and 
InterSAN's Pathline, are designed to 
work in heterogeneous environments. 

Storage management vendors are 
working to combine the capabilities of 
both SRM and SAN tools to optimize 
storage use in real time, according to 
established policies and processes. 
Active storage management tools are 
being developed by Veritas, EMC, 
IBM, Hewlett-Packard and Sun 
Microsystems, among others. 

INFORMATION UFEGYGLE 
MANAGEMENT 

Not all data is created equal. Organiza- 
tions "embrace information lifecycle 
management because they understand 
that the value of data changes over 
time," says Pat Martin, chairman, pres- 
ident and CEO of StorageTek. 

The value of data, adds Steve 
Duplessie, a senior analyst at the 
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Enterprise Storage Group, "is the one 
overlooked variable that really screws 
everything else up. We tend to treat 
data the same from inception to death, 
but clearly the value of the data 
changes over time, and as such should 
be treated differently." 

Information lifecycle management 
(ILM) software addresses this problem 
with the concept of a lifecycle: data is 
treated uniquely according to its com- 
parative value, and, as that value 
changes, the level of accessibility and 
protection it gets is altered dynamical- 
ly. The result: better quality of service 
at reduced cost. 

Sounds good, but it's tough to 
implement in the heterogeneous, net- 
worked IT environments that serve 
many organizations. Many tasks — 
including the abilitv' to understand data 
within the context of its file system or 
application as well as data replication, 
volume management/virtualization, 
migration and archiving — must be coor- 
dinated across a variety of network, sys- 
tem and storage platforms. 

Well-designed data and storage man- 
agement policies can help, says analyst 
Steve Kenniston of the Enterprise Stor- 
age Group, calling them "the beginning 
of true information lifecA'de management 
and the ability to monitor data growth 
better for planning purposes. By manag- 
ing what data lives where and at what 
time, you can control how data is pro- 
tected and increase protection la'els." 

THE CHALLENGES 

What does it take to make storage con- 
solidation happen? 

Security. "There are certain vulner- 
abilities that arc introduced when con- 
solidating and net\vorking data," says 
Enterprise Storage Group's Marrone. 
"The benefits of consolidation may out- 
weigh the risks, but organizations must 
perform additional securitv' assessments 
to make sure data is secure. Data 
deemed critical to the business should 



be protected by more than just an exter- 
nal firewall." She suggests encryption 
for "data at rest" so that critical infor- 
mation is not compromised. 

Getting everybody together. 
"The first thing a CIO needs to do," 
says Hugh Hale, director of technical 
services at Blue Cross and Blue Shield 
of Tennessee (BCBST), "is to make cer- 
tain all of it's various support groups 
come together and develop one, broad 
strategy. Convincing all the technical 
support groups to play together is the 
biggest challenge." 

Hale advises focusing on each group 
and getting them to consider potential 
solutions from an enterprise p>erspective: 
What's the most efficient? What works 



A significant, sustained inter- 
ruption of enterprise opera- 
tions or uifbrmation flow can 
drive a company right out of 
business. Adding to the pres- 
sure are recendy passed laws 
and initiatives — including the 
Graham-Leach-Bliley Finan- 
cial Services Modernization Act, the 
Healthcare Information Portabilit\' and 
Accountability Act (HIPAA) and the 
European Data Privaq' Directive — that 
hold organizations responsible when 
personal data goes astray or corporate 
information isn't preser% ed. 

Yet according to the research firm 
Gartner, fewer than 30 percent of For- 
tune 2000 companies actually have a 
full business continuity plan in place. 
Fortimately, tliere are more ways than 
ever to safeguard data and the systems 
that move and store it. 



best for everv'one? For the community? 

He also suggests putting the problem 
and proposed solution to management: 
Convince company executives that creat- 
ing a homogeneous environment is so 
much better in the long run, Hale says. 

"I had to explain to them that, 
yes, while it's true I could buy a server 
that is better than the ones we have 
installed, if you take a look at the total 
environment, the homogeneous envi- 
ronment is easier to manage, takes the 
least amount of staff, and we get 
tremendous vendor support," he 
recalls. "We found discussions center- 
ing on reliability' and availability of the 
applications very effective in getting 
cxecurivc buy-in." SD 



DEVELOPING A BUSINESS 
CONTINUITY PLAN 

The challenge is to understand your 
business suflficiently that you can deter- 
mine which processes it needs to stay 
alive, and then ascertain all the essen- 
tials — physical facilities, employees, 
skills, training, etc. — necessary to diose 
processes. Some best practices: 

Assessing risk: Do you under- 
stand your business? To figure out 
where your organization is vulnerable, 
you'll need to assign a project team that 
consists of IT, security' and business unit 
statT. The team's job is to identify' and 
prioritize mission-critical business 
processes and evaluate downtime costs. 
TTieir deliverables: conclusions about the 
costs of downtime for your business, 
what it'll take to recover the as'ailability 
of key processes and what kinds of serv- 
ice availability key applications require. 



BUSINESS CONTINUITY 

AND DISASTER RECOVERY: 

PREVENTING BUSINESS INTERRUPTION 
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Rorke Data, a subsidiary 
of Bell Microproducts 

Email: l|jroii(e(a(rori(e.coiii 
Plione: 800-328-8147x7880 



www.rorke.com/enterprise/ 

Data Storage & Email Solutions that meet regulatory compliance 
for SEC 17a-4, Sarbanes-Oxely &, HIPAA. 
Open and Scalable solutions that integrate high speed, on-line disk 
storage with regulatory-compliant WORM media. Option to inte- 
grate email management for small to large Microsoft Exchange 
environments is available as well. Rorke Data solutions scale from 
2TB to 100TB plus!! 



3 PAR 

Serving Information 



3PAR 

E-Mail; salesinfofSpardata.com 
Plwne: 868-372-7226 



www.3pardata.com 

SPAR Utility Storage is an intelligent and highly functional disk array 
subsystem. With breakthrough hardware and software innovtions, 
SPAR overcomes the complexities, cost, and functional limitations 
of current storage solutions. SPAR has delivered Utility Storage 
solutions to the government sector, both to the U.S. and abroad, 
and to the commercial sector, which includes financial services, 
technology bio-pharmaceutical, and telecom companies. 



And tfie cost of DASD is more tlian just 
the acquisition cost, there is the cost of boclcing 
up the storage, the telecommunication cost of 
replication and the management cost. Wouldn't 
it be better to manage the DASD you already 
have before you buy more? 



Know 



When It's FREE! 

For more information on how to increase 
your utilization and manage your mainframe 
DASD more effectively, contact DTS Software at 
770-922-2444 or email: info@DTSsoftware com. 



9r DATA PROCESSING 



SOFTWARE, INC. 



Innovation Data 
Processing 

275 Paterson Hvenue 
Uttle Falls, NJ 07424 
Plwne: 973-890-7300 
fax: 973-890-7147 




www.innovationdp.fdr.com 

Innovation Data Processing is an enterprise business data protec- 
tion leader with the FDR Family of Storage Management products 
including FDR/UPSTREAM for Open Systems, and zLinux, lAM for 
VSAM application acceleration. FDRINSTANT extends data replica- 
tion technology of storage vendors such as FlashCopy with non-dis- 
ruptive protection. FDRPAS provides economical non-disruptive disk 
and volume relocation making new hardware installation a snap. 



For more information and up to 
date storage research 
and resources please go to: 

iviviv. c\o. com/resea rch/da ta 



STIHTEtlC gilECTIlllS 17 



CIO ADVERTISING SUPPLEMENT 



IITI 5TBHIEE SIHTIOIIS | DI51STEH HECDVEHT 



Designing business continuity 
and recovery plans. Repeatable recov- 
ery strategics and processes are delineat- 
ed, including the formalizing of business 
continuit)' policies, management, and 
auditing and creation of crisis manage- 
ment teams and procedures. Scr%icc lev- 
els should be defined using classification 
systems that lay out requirements for 
infrastructure, operations architecture 
and development endeavors. 

Building a business continuity 
response. As business continuity designs 
arc assembled, detailed plans and rou- 
tines are formulated for those handling 
daily operations. Then, as much as pos- 
sible (since some plans may not be 
testable), they're tested. And tested. 
And tested again. This begins an itera- 
tive process — ongoing testing results in 
adjustments to the plan, improving 
chances of sur\i\ing a disaster. 

Monitoring and maintenance. 
Because business requirements are always 



changing, business continuity plans must 
be frequentiy updated. Part of yt)ur busi- 
ness continuity plan design and construc- 
tion should address procedures for 
reviewing the plan and making changes 
as necessary. Testing should be continu- 
al — and don't forget .staff rehearsals. 

Ck)ntinuity in the culture. If busi- 
ness continuity processes are integrated 
into every project life-c\'cle and change 
management process, then continuity 
and recovery requirements can be 
understood and incorporated as new 
projects and processes are initiated. 
You'll also need a continuing campaign 
to improve business continuity policy 
awareness and management practices 
across the organization. 

TECHNOLOGIES THAT MAKE BUSINESS 
CONTINUITY PUNNING EASIER 

To provide true continuity' for critical 
business processes, not just critical data, 
companies must: 



■ Maintain a variety of redundancies 
dedicated to business continuity, 
including redundant network capaci- 
ty', electrical supplies from different 
power grids and offsite location of 
failover gear 

■ Assure immediate availability' of ade- 
quate latent capacity to sustain rapid 
failover and recovery 

■ Find ways to test capacity availability 
without disrupting current operations. 

Among the technologies that make 
these efforts easier: 

High-availability solutions that 
enable organizations to recover in min- 
utes rather than days. SPARdata's stor- 
age servers, for instance, combine hard- 
ware and software fault tolerance so 
software can be upgraded online, and 
are scalable from entry-level installa- 
tions to large, centralized .systems. 

Distributed applications architec- 
tures in which applications architectures 
inhabit several active physical sites so 



CONPINT PROFILE 



^ T departments today are under pressure to provide ever- 
H ' higher levels of service vi/hile reducing operational and 
H [ infrastructure costs. To meet these challenges, more and 
H I more IT departments are shifting to a utility model that 
H ' delivers computing power and stor- 
age capacity from shared, central- 
ized resources. 



VERITAS 



NEW TOOLS AND CAPABILITIES 

Managing the utility model requires new tools and 

capabilities. With the VERITAS one-source SRM solution, IT professionals 

can facilitate the transition to utility computing from a storage perspective. 

The VERITAS SRM solution provides storage management from three 
integrated products: VERITAS SANPoint Control covers physical storage 
management; VERITAS Storage Reporter takes care of logical storage 
management; and VERITAS Service Manager for Storage performs busi- 
ness management functions. 

•VERITAS SANPoint Control provides centralized, proactive management 
of the storage infrastructure. Seamlessly integrating policy and perform- 
ance management, storage provisioning, and zoning capabilities, VERITAS 



SANPoint Control simplifies the complex tasks of managing and monitoring 
a multi-vendor networked storage environment. 

•VERITAS Storage Reporter enables IT organizations to know exactly what 
users, applications or file types are consuming valuable storage space. With 
Storage Reporter, IT managers get a complete 
view into the usage of storage across the enter- 
prise, allowing them to raise storage utilization 
rates to the point where they quickly recover their 
software investment. 
•VERITAS Service Manager for Storage helps 
organizations align IT strategies with business priorities. VERITAS Service 
Manager allows IT to centrally manage delivery of IT storage services and 
quantify the results of expenditures by providing complete business-level 
reporting of storage utilization, costs, and service-level delivery. 

The VERITAS SRM Suite is the one-source solution for IT departments 
seeking the most reliable and economical vray to meet storage and avail- 
ability requirements. 

For more information about utility computing from a storage per- 
spective, visit vmw.veritas.com 
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WHERE THE PAYBACKS ARE: 

THE ROI OF STORAGE SOLUTIONS 

Here are Some of the Results Companies Have Used to Support Their Business Cases: 

When COPIC Insurance was moving from a mainframe to an Oracle platform, it needed to 
migrate lots of legacy data but lacked the SQL experience needed to do so. Using Informat- 
Ica's data integration platform, the migration was finished in nine months (vs. the usual two 
years) with just two developers, and one migration project saw cost savings of 50 percent. 
What's more, COPIC's data warehouse maintenance and support costs are significantly 
lower and it's easier to train developers. 

Brokerage house Legg Mason used Legato's DiskXtender and ApplicationXtender to create 
a cost-effective data management solution capable of handling massive amounts of data. 
Working in conjunction with Legg Mason's corporate intranet, the solution has virtually elim- 
inated the company's need for paper report delivery and storage and reduced the time nec- 
essary to retrieve client documentation from hours (sometimes days) to seconds. 

Implementing Storage Tek's Virtual Storage Manager helped soy sauce maker Kikkoman 
reduce the 1,500 magnetic tapes required to record its mission-critical data to Just 500 
tapes— a savings of about 67 percent. 

One of the largest suppliers of products and services to the global semiconductor indus- 
try. Applied Materials, realized a $2 million savings in storage costs in the first year after 
implementing OuterBay's LiveArchive software — and has saved $1 million in storage costs 
every year since. Applied Materials was also able to reduce database growth rate from 156 
gigabytes to 16 gigabytes a year— an annual growth rate reduction of 90 percent. 

Application services provider USintemetworking, Inc. (USD, reports getting four to five times 
better backup speed with Veritas NetBackup DataCenter compared to its previous solution. USi 
is also able to restore any server or packaged application completely from the ground up. SO 



that if one center goes down the others 
can .still prcKcss application requests. 

Load balancing across multiple 
physical sites (generally for non-transac- 
tional apps) and hot standby, a redundant 
application environment that's available 
when an outage hits the primar\' physical 
site, for transaction applications allexiate 
the complexity' of multiple-site design 
and ease conflict resolution. This reduces 
complexity and improves the chances tor 
conflia resolution. For hot-standby and 
load-balanced sites, data is often replicat- 
ed between sites via mirroring or shad- 
owing (at the transaction or data level). 

Data replication — notably mir- 
roring and shadowing — are used often 
with load-balanced and hot-standby 
sites, replicating databases and file sys- 
tems. Point-in-time replicas synchro- 
nize backup and recovery across mul- 
tiple systems. 

Clustering, which replicates data 
Ix'tween sites, monitors site availabilit)' 
and responds to outages by conduct- 
ing automated recovery at the alterna- 
tive .site. 

Snapshots capture, well, snap- 
shots of data. EMC Corp.'s Snap, 
which works with the firm's Symmetrix 
DMX networked storage products, 
generates pointer-based snapshots of 
production data volumes. 

Storage management software 
delivers the abilit)' to move files c]uick- 
ly and recover even the largest data files 
in minutes. StorageTek's Application 
Storage Manager, for example, exploits 
storage virtualization and automates 
data management and retrieval across 
the storage hierarchy via user-defined 
data policies. 

DTS Software's Storage Control 
Center is comprised of an integrated 
suite of storage management programs 
that handle backup, debugging, uti- 
lization monitoring, disk space recov- 
ery, and DASD and tape management. 

Rorke Data's global namespace 
management applications allow clients to 



access files without knowing their l(x:a- 
tion. Administrators can aggregate file 
storage across heterogeneous, geograph- 
ically distributed storage devices, and 
view and manage it as a single file system. 

Vendors are also working together 
to create comprehensive business conti- 
nuity' solutions. For instance, KMC has 
joined with Legato and Nortel Networks 
to otYcT a solution that allows disparate 
data centers to behave as one. In event of 
an outage, transactions arc automatically 
rerouted to an alternate site without 
requiring restore or restart prtKcdures. 

BlueStar Solutions, a provider of 
hosted enterprise-class applications, is 
using Veritas' Volimie Replicator to 
shrink data loss to no more than 1 5 
minutes (with a guarantee that the data 
is consistent and applications can be 



brought back up). BlueStar has also 
reduced downtime to only 10 minutes 
from start to systems recovery in its 
alternate data center using Veritas' 
Global Cluster Manager. 

Innovation Data Processing's 
enterprise storage management soft- 
ware has helped M&T Bank's enter- 
prise storage department take on back- 
up tasks without needing dedicated 
tape drives to do it. 

Unified enterprise data manage- 
ment solutions ensure high-perform- 
ance data protection, universal avail- 
ability and simplified management of 
complex storage networks. The Com- 
mVault software platform, for instance, 
integrates backup and recovery, data 
migration, data high availability and 
storage management software. SO 
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Only VERITAS detects, diagnoses, and corrects performance problems from application 
to storage array. Stop the finger pointing by pointing your browser to veritas.com 
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RELATIONSHIPS 

""""CONTROL 

YOU NEED TO GET SMART FAST 



Do you know how to break through vendor hype? How far 
can you trust vendor analysts? Can you successfully nego- 
tiate with vendors? Should you take customer references 
with a grain of salt? Do you know how to Influence vendor 
development? Turn to the CIO FOCUS'" on SOFTWARE 
VENDOR RELATIONSHIPS: SELECTING, VETTING AND 
MANAGING PARTNERS— actionable information created, 
filtered and packaged by the award-winning editors of CfO 
magazine. 

CIO FOCUS™ is delivered right to your desktop, giving you 
immediate access to the information you need. And for your 
future reference needs, the electronic file is followed by a 
packaged version, shipped within 72 hours. Available now at 
an introductory price. 



OTHER CIO FOCUS"" 
TOPICS AVAILABLE: 

► IT Value: Measurement Tools 
and Techniques That Work 

► Fundamentals of the CIO Role 

*■ Applied Wireless: Making 
Wireless Work in Business 

► Securing Information Assets: 
Planning, Prevention and 
Response 

* The Elite CIO: Going Beyond 
the Basics 



CIO FOCUS 



STRATEGIC GUIDES FOR EXECUTIVE DECISION MAKING 



The Resource 
for Information 
Executives 



www.TheCIOStore.com 



trendlines 



On the Move 



By Meridith Levinson 



Deasy Sees Opportunity 
at Troubled Tyco 



AFTER THREE AND a half years of tireless 
politicking, relationship building and air 
travel, Dana Deasy felt he had accomplished 
what he had set out to do. As vice president 
and corporate CIO of the Americas for 
Siemens, Deasy had aligned 
the company's 15 North 
American CIOs around a 
global IT strategy. Now, Deasy 
felt, he had effectively become 
the "Maytag repairman of 
Siemens." (Read more about 
his work at Siemens in "The 
World According to Deasy," 
www.cio.com/printlinks. ) 

So when he received a call 
in May from a recruiter with 
Russell Reynolds Associates 
while waiting for yet another flight, Deasy 
was poised to hear the recruiter's pitch to 
become a company's first-ever global 
CIO — even though that company was 
Tyco, the embattled conglomerate whose 
former executives have been in hot water 
for allegedly cooking its books. "I had 
accomplished just about all the goals I had 
set out to accomplish when I set up the 
CIO organization at Siemens," Deasy told 
CIO just before he joined Tyco in July. 

"Tyco presented one of those irresistible 
opportunities that many CIOs look foi;" he 
adds. "It's not too often you get to go into a 



DANA DEASY 



$36 billion company that's never had a 
global CIO and get to establish the [CIO] 
organization from the ground floor up." 
Among the reasons why Deasy found Tyco 
an "irresistible" opp>ortunity: 

• Personal growth potential. 
Deasy served as a regional 
CIO at Siemens. Now he had 
the chance to join the ranks 
of global CIOs and extend his 
authority. 

• A greenfield. The global 
CIO position was a new one 
at Tyco, so Deasy wouldn't be 
stepping into someone else's 
shoes — inheriting someone 
else's baggage, processes or 
ways of doing things. 

• A new management team. Deasy was 
attracted to Tyco's fresh blood and high 
energy at the top, including a new CEO 
and new CFO. Many other execs had been 
in their positions for less than a year when 
Deasy joined in July. 

• Direct line to the CEO. Reporting to 
Chairman and CEO Ed Breen, Deasy can 
have a direa impaa on shaping the com- 
pany's strategic direction and operations at a 
time when Tyco is trying to reclaim its cred- 
ibility with shareholders and Wall Street. 

• Familiar organizational turf. Deasy says 
he would be able to apply what he learned 




More CIOs are taking operations and administrative posts. Thomas A. Lesica. 

former CIO at J. Crew and Pepsi-Cola, is now group vice president of global IT 
and business operations for Avaya. Eric Berg, former Goodyear Tire & Rubber 
CIO, became NCR's first chief administration officer. Rudolph Huber, vice president 
and CIO at Alcoa, in July became vice president of Alcoa Global Business Services 
and CIO. Peter F. Longo. a certified public accountant and former vice president and 
CIO for Pratt & Wtiitney. is CFO of Sikorsky Aircraft. For more job changes, see our 
updated "Movers & Shakers" column at www2.cio.com/mo\/ers. 
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Dana Deasy's Resume 

CURRENT POSITION 

Senior Vice President and CIO, 
Tyco International Ltd. 

WORK EXPERIENCE 

• October 1999-Ju\y 2003 Vice President 
and CIO of the Americas. Siemens Corp. 

'June 1997 -September 1999 CIO, 
General Motors Corp.'s Locomotive Group 

' December 1994-May 1997 Director 
of Information Systems. Invetech Co. 

• June ]98]-November 1994 Director of 
Information K/lanagement. supporting 
Rockwell's Space Shuttle program. 
Rockwell Space Systems Division 

EDUCATION 

MBA from National University. San Diego 
BS in Business Administration from the 
University of Southern California, Los Angeles 

at Siemens (like building an esprit de corps 
among a geographically dispersed group 
of executives) to Tyco because the two 
global manufacturers share similar decen- 
tralized structures. 

Deas>''s overarching goal: Help Tyco's sen- 
ior management get the company back on 
track. He plans to do so by creating a unified 
IT strategy for the company that all the 
regional and divisional CIOs buy into, by 
restructuring IT contracts with vendors and 
by consolidating IT operations where possi- 
ble to save costs. 

Shawn Banerji, the recruiter who tapped 
Deasy for the global CIO position, says 
Deasy's comportment makes him a perfect 
fit for the new Tyco as does his ability to 
influence others, which he demonstrated 
at Siemens and which will come in handy 
as he tries to unify Tyco's disparate IT 
organizations. "He's authoritarive and very 
credible, but he's not a snob," says Banerji 
of Deasy. "He's very inclusive. You've got 
to have that at a place like Tyco. His abil- 
ity to influence others and get their buy-in 
and mindshare is incredibly important." 
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when you upgrade your old printer 
to a new HP printer, you may actually 
save more money than you'll spend. 

HP innovoHon has led to new enhancements in printing that 
can help dramatically reduce your operating costs. In many 
cases, you may save enough in power, consumables and 
support-related costs to completely pay for on upgrade. 
Combine this with special rebate incentives, and it's easy to 
see how a new HP printer can lead to significant savings 
for your company. Gel more with HP printers. 



Save even more v/ith rebates from $50 to $2,000 

on over 40 different models of HP printing and digital imaging products. 



For more information or to find a reseller near you, call 1-866-625-1 174 
or visit www.hp.com/go/getmore. 



invent 



Wtiiie many users of new HP printers may experience cost savings, your results may vary. Visit www,hp,com/go/gelmore for complete listing of eligible products and rebate terms and conditions. HP reserves the 
rigtit to ctiange or cancel this program at any lime viittiout notice. ©2003 Hewlett-Packard Development Company, L.P 
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All Global Politics 
Is Local 




MATTHEW SLAUGHTER, coauthor of Globaiization and the 
Perceptions of American Workers, is an associate professor 
of business administration at Dartmouth College. CIO 
Executive Editor Christopher Koch recently sat down with 
Slaughter to discuss globalization, technology and IT jobs. 



CIO: You've studied American opinion 
on globalization for years and found that 
most Americans don't support global- 
ization if it will affect jobs in the United 
States. How does that translate into 
political support for economic policies? 

Matthew Slaughter: There is a real 
schism between what people think of 
globalization and what they think of 
technology. People understand that to 
get the gains from technology innova- 
tion, you have to accept some job loss. 
But what's striking is that if you have 
the same sorts of survey questions and 
replace "technology innovation" with 
things such as "trade" and "foreign 
direct investment," people's opinions 
are almost completely flipped around. 
The majority of Americans support the 
churning in the process of technology 
innovation; and the same majority of 
people oppose those same sorts of 
dynamic forces from globalization. 

If you look back at the last big labor 
transition, between farm work and 
manufacturing, the transition seems to 
have fewer financial repercussions than 
the shift of white-collar work offshore 
that we're seeing today. The farmers 
were not investing huge sums of money 
in their children's education and were 
not gathering years of specialization in a 
particular job to see that job displaced, 
followed by a substantial loss of income. 

Those sentiments are real, and they are 
important in terms of thinking about 
what I should do for myself and for my 
kids and how I should vote. Mechaniza- 
tion in agriculture meant you just didn't 
need all those people working on the 



farms. It's the same thing today. Why 
should I spend all this money on college 
education when I don't know if my 
children might have a job when they 
graduate? The sentiments are always 
present in a market economy where you 
have this churning going on. They are 
heightened in recent years, particularly 
in IT, because these processes have 
become much more a part of how 
business gets done. 

In the past, the low-skilled, low-income 
workers were the ones being displaced. 
Now you're talking about people who are 
really at the power core of this country: 
knowledge workers. What do you think 
will happen, given the high degree of 
political power that these people have? 
Will there be a strong political reaction? 

I don't think so. Not in terms of shutting 
down globalization. Very few IT execu- 
tives could reasonably argue that their 
companies are not better off today than 
they were 20 years ago because of 
globalization. Not just in terms of their 
companies' profitability but in terms of 
their incomes. The more important 
benchmark is not where you were in 
terms of income in 2000, but where you 
were in 1993 and 1983— where you 
might see more activity in terms of the 
labor market. There will be pressure to 
make it easier for people to have 
portability of pensions and be able to 
gain education later in life, the kinds of 
things that will enable workers to better 
transition from these kinds of shocks. 
The U.S. labor market lacks a lot of 
those buffers that I think would amelio- 
rate a lot of the sentiment that's out 
there about this insecurity. 




This Date in 

IT History 

Father of the Photocopy 

1945 10-22-38 Astoria. 
So read the world's first 
photocopy on Oct. 22, 1938, in 
Astoria, N.Y. Physicist Chester 
Floyd Carlson and his assistant 
Otto Kornei. while dabbling in 
photoconductivity, poured 
sulfur across a zinc plate and 
zapped it with a white-hot light. 
Carlson then blew the remain- 
ing sulfur from the sheet, and voilSI The paper read 
"10-22-38 Astoria." an exact duplicate of the scrib- 
bling on a microscope slide that lay across the plate. 

Carlson pitched his invention to companies such 
as GE. IBM. Kodak and RCA but was rejected by all of 
them. (Reiectlon and loss became a familiar theme 
for Carlson during the next six years; his wife left him. 
his assistant Kornei left him, and a heap of debt 
accumulated all thanks to his copying pursuits.) But 
then, in 1944. the nonprofit Battelle Institute offered 
Carlson $3,000 for further research in exchange for 
three-quarters of future royalties. After the rights to 
his invention were purchased by the Haloid Co. (later 
Xerox) and the Greek term xerography (translation: 
"dry writing") was coined. Carlson went on to bank 
$150 million and became the father of possibly the 
most ubiquitous piece of contemporary office 
equipment. -DanieU. Morgan 

Other Notable Events 



The Soviets jump to an 
early lead in the space 
race with the launch of 
Sputnik on this day in 
1957 



The first radio conversa- 
tion with a submerged 
submarine happens in 
1919. The U.S.S. H-2 
radioed the destroyer 
Blakey from the depths 
of the Hudson River 



From the confines of the 
Apo//o / spacecraft, the 
first live telecast from 
space takes place 
in 1968 



Thomas Edison, inventor 
of the electric lightbulb, 
the universal stock ticker 
and the motion picture 
camera dies in 1931. 



The Justice Department's 
antitrust trial against 
Microsoft gets underway 
in 1998. Microsoft is 
accused of bullying PC 
makers into providing 
Explorer as the default 
browser instead of rival 
Netscape Navigator 



SOURCES Adou! com. 
ratrbanks North Star Borough 
School District. History 
Channel. HowStutfWorks, 
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Connected business. 



Introducing NEC's vision of the Connected Enterprise. It s just 
not enough to align and connect the dots in your business 
anymore. Not when your competitors have IT infrastructures 
that perform at a whole new level. These infrastructures inte- 
grate business processes and real-time information - about 
customers, employees, partners and suppliers - into clear 
pictures that are accurate and actionable. 

To help companies compete in a changing and challenging 
business environment. NEC Solutions America has united our 
world-class products and services to bnng you a very agile 
and resourceful solutions provider. Using an open and holistic 
approach, NEC brings together best-of-class hardware. 



software and services, with vast experience in mobile enterprise 
computing, business intelligence, biometric security, business 
service management and visual display solutions. The result: 
enterprise knowledge that empowers your company in new 
ways, to create measurable improvements in performance, 
efficiency and ROI. 

That's NEC's vision of the Connected Enterprise. And we're 
turning that vision into real-time reality for businesses one 
enterprise at a time. To connect with us, call 888-632-7003 or 
visit www.necsam.com/connected. 
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Culture Clash 



You don't need a degree in anthropology to negotiate 
multicultural IT projects. But as this IT exec 
discovered, having one sure doesn't hurt. 

BY PATRICIA ENSWORTH 

WHEN COLLEAGUES LEARN that my graduate degree is in anthropol- 
rather than business or computer science, they're usually 
puzzled. They assume that I've changed careers, or that study- 
ing human cultures is an interesting but frivolous hobby — ^like, 
say, building model ships. 

In faa, over the years my expertise in anthropwlogy has turned 
out to be one of the most valuable tools in my management kit. 
It's particularly helpful now, when more and more IT projects are 
becoming collaborative endeavors at locations around the world, 
involving people of vasdy different backgrounds. 

Consider my experience at Moody's Investors Service. I 
joined the credit rating agency in 1993 when it was embarking 
upon a major expansion outside the United States, as well as 
undertaking an ambitious strategy to replace legacy mainframe 
processes and standalone desktop applications with a more 
efficient global data architecture. Today, Moody's publishes 
ratings and research electronically in real-time on its website. Its 
analysts gather information about market conditions affecting 
companies, governments and debt instruments wherever peo- 
ple issue bonds to raise capital. Its internal systems integrate 




financial, HR, marketing and workflow operations in offices on 
every continent except Antarctica. 

As an IT manager, one of my responsibilities was serving as 
the liaison between the central systems development group at 
the U.S. headquarters and the developers and end users in other 
countries. TTiat meant leading projea teams of staff members, 
consultants and vendors who were multinational, multiracial, 
multiethnic, multireligious and multilingual. 

Changes in Latitudes, Changes in Attitudes 

You might think that a multicultural IT projea is much the same 
as any other. After all, developers who employ the same pro- 
gramming language can usually decipher each other's code even 
if they don't speak the same human language. English now unites 
the rr world as Latin once united the Roman Empire. Yet in my 
experience, multicultural projects almost always generate con- 
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flicts. And that's because people from different cultural back- 
grounds have different notions of leadership. In sum, global 
workers have varying attitudes about the importance of deadlines, 
the flexibility of rules and even the need to write things down. 

At Moody's, these cultural differences hampered our ability 
to condua software testing and engineering process audits. 
Effective quality assurance requires an independent persf)ec- 
tive and an open acknowledgment of defects. Until the mid- 



Workers around the globe have varying attitudes 
about the importance of debate, deadlines and rules. 



1990s, in a largely homogenous American development 
environment, the dynamics of QA methodology depended on 
three very American values. The first was the egalitarian ideal 
of social intercourse — the way distinctions of rank are sup- 
posed to be minimized in our daily interactions. The second, 
emerging from the first, was the informal give-and-take Amer- 
icans learn in school as they're encouraged to express opin- 
ions, challenge other students (and sometimes even the teacher) 
and brainstorm solutions. TTie third was the "tell it like it is" 
approach to conflict resolution, in which criticism may be 
expressed, ideally without shame or fear of reprisal. 

But many of the IT workers who have emigrated to the 
United States within the past 10 years do not share those values, 
and they follow radically different codes of conduct. For some, 
a caste system or other rigid hierarchy establishes the ground 
rules of social relations. For others, education means rote learn- 
ing and stria obedience to authority. In many cultures, open dis- 
agreement and direa criticism entail a painful loss of face and 
thereby close off the possibility of ever resolving anything. 

As these values and behaviors collided, gaps in communica- 
tion began to appear. The relationship between develojjers and 
testers changed. Developers have always enjoyed a higher status 
than testers, yet the formal organizational and informal social 
disparity widened dramatically. Testers became less willing to 
criticize and possibly shame their betters, and developers became 
less willing to collaborate with their inferiors. 

Discouraged from pursuing a challenging, intellectual give- 
and-take with developers, testers sought to demonstrate their 
productivity by running lots of easy, superficial tests and gen- 
erating reams of documentation. And although on paper it 
looked as if we were allocating more and more resources to 
quality assurance activities, in reality our test coverage and our 
process audit funaion were in decline. 

Many other companies experience the same dilemma. In 
response, some organizations seek to employ Capability Maturity 



Models or Six Sigma for reconfiguring their processes. Instead, we 
opted for a simpler solution. We found that culture shock prob- 
lems could be resolved — or avoided — by making a minor but 
significant organizational change. A QA manager was appointed 
at the projea manager level. Testers reported to both a projeCT 
manager and the QA manager in a matrix relationship, raising 
dieir status in their own eyes and in the eyes of the developers. The 
QA manager became responsible for coordinating standards and 
procedures across the projea teams. 

The QA manager also served as an 
ombudsman, combining the functions of 
a diplomat and a parliamentarian. Not 
only testers, but also developers, business 
analysts and product managers were 
encouraged to regard the QA manager's 
office as a place where they could express sensitive concerns. In 
an environment where individuals were sometimes embarrassed 
to call attention to the cultural differences, the QA manager was 
usually able to approach the issue as a matter of workflow or 
communication protocol, allowing everyone to save face. After six 
months of this arrangement, test methodology and coverage sub- 
stantially improved. Issues of engineering process and risk analy- 
sis were being discussed of)enly again. Both developers and testers 
felt that communication had become easier, 



Skirting the Iceberg 

It's an understandable mistake to misdiagnose cross-cultural 
conflicts as issues of personality or job performance. Like an ice- 
berg, most of a person's cultural identity is below the surface. 
Differences in accent, clothing, table manners — those are obvi- 
ous and therefore relatively easy to maneuver around. What 
don't show are core beliefs and the questions they engender 
such as: What is fair? What is proper? To whom or what does 
one owe allegiance? What are the boundaries of ambition and 
responsibility? Those submerged incompatibilities pose the 
greatest danger to successfully navigating IT projects. 

At Moody's, I was the QA manager who confronted these 
issues. But nowadays, you may not need a professional anthro- 
pologist. An increasing number of organizations provide train- 
ing in multicultural management. This praaice makes good 
business sense. Not only can it help avert problems, it can also 
show IT executives how to transform their workforce from 
mistrustful tribes eyeing each other across the cultural divide 
into a corps that profits from each other's perspectives. HEl 



Patricia Ensworth. a former vice president at Moody's 
Investors Service, is the author of The Accidental Pro- 
ject Manager. She is president of consultancy Har- 
borlight Management Services and can be reached at 
info@harbor/ightmanagement.com. 
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No Wi-Fi? You re Covered. 



Enterprise mobility applications based on 3G CDAAA wireless networks ore revolutionizing business in ways that Wi-Fi can't. 
Offering ubiquitous coverage and speeds better than landline dial-up, you'll have instant access to your office, even if you 
aren't at a location that offers Wi-Fi. That translates into more time each day that you're operoting at peak efficiency. Best of 
all, you won't be limited by Wi-Fi "hot spot" availability. Remember, not all wireless technologies are created equal. To find 
out what the differences are, ask your wireless provider whether they offer true nationwide 3G services. 
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Tom Davenport I The New Work Order 

Retooling the Knowledge Worker 



Putting It AH 
Together Again 

Knowledge worker productivity: 
your questions answered 

THIS BEING THE LAST in a series of columns here about knowledge 
worker productivity, I thought you might be expecting some 
answers. One thing I know for sure: Depriving knowledge 
workers of sleep is definitely not a route to enhanced produc- 
tivity. I started this column on my way to Thailand (and highly 
sleep-deprived), and it turns out I was not very productive at all! 

But before I answer your questions about what does work 
well, a brief review of the problems might be useful. 

■ Knowledge work is hard to measure, so most of us don't bother 

■ Although not all knowledge workers are alike, there is no 
standard classification or segmentation scheme for them. 

■ TTiere are lots of "productivity tools" for knowledge work- 
ers — too many — but they don't connect well with each other 

■ TTie organizational support for knowledge work is similarly 
fragmented and comes from a variety of IT organizations, 
human resources, facilities organizations and so forth. 

So how do we put this Humpty Dumpty back together 
again? One approach is to integrate the various technologies 
that knowledge workers use. In the past week, for example, 
I've met several people who have shifted to PDA/cell phone 
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combo devices — not because they are cool gadgets, but because 
they hold the potential for simplifying life. At the very least, they 
can reduce the number of devices to carry and limit the num- 
ber of name-and-address files to manage. 

By the same logic, the fewer computers one uses, the better. 
Many people have begun to use their work laptops for all their 
computing needs. That is, of course, if your organization does- 
n't mind you using its machine for personal applications and 
messaging, and that you don't mind using a laptop for every- o 
thing. A lot of people (including me) already carr)' a laptop ^ 
everywhere, so we might as well get the benefits of "architec- ^ 
tural consolidation" and bag the home desktop altogether " 

Another IT-related approach is to integrate the various sup- z 

o 

port groups for knowledge worker technologies. At most large ; 

01 

organizations today, there's one group to support messaging « 
technologies, one for knowledge management, one for per- i 
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sonal productivity applications and perhaps another for help on 
wireless communications devices. The different groups mean 
that IT is unlikely to develop an integrated approach to helping 
knowledge workers use these tools effectively. The individual 
employee is left to his own devices, so to speak. 

I came across one organization that is addressing this prob- 
lem, however. Intel's IT organization has recently reorganized 
itself to combine the knowledge management, collaboration and 
personal producrivit>' groups. Gilled eWorkforce, the group sup- 
ports knowledge worker use of PCs, laptops, cell phones and 
PDAs. The primary goal is to develop integrated solutions for 
"generic" knowledge worker processes — arranging and con- 



Since all knowledge workers aren't alike, we need 
to segment them into meaningful categories and 
apply IT and process improvement approaches 
differently for each category. 



ducting an asynchronous meeting or managing a project. While 
I believe it's a great step forward to integrate devices and sup- 
port organizations, I'd argue that to make real progress in 
knowledge worker productivity, we need to disintegrate the 
target audience. That is, since all knowledge workers aren't 
alike, we need to begin to segment them into meaningful cate- 
gories and apply IT, process improvement approaches and other 
productivity aids differently for each categorj'. 

The question is what sort of segmentation scheme to use. 
Intel has created one based primarily on behaviors and atti- 
tudes toward technology'. Its categories are as follows: 

■ Functionalists — Primarily manufacturing workers (but includ- 
ing some office workers) who use IT occasionally but don't 
rely heavily on "office IT" to perform their job functions. 

■ Cube captains — Spend the majorit)' of their time in the office, 
are very mainstream in their office IT needs and are overall 
very happy with the tool sets they have. 

■ Nomads — Heavy users of remote access and mobile IT, 
whether while traveling or working in remote offices. 

■ Global collaborators — Interface often with people around 
the world; they resemble nomads but work across time zones 
and need access to collaboration tools, anywhere, anytime. 

■ Tech individualists — ^They want and adopt early the latest 
IT tools and are willing to take risks with them. 

These probably wouldn't be the right categories for all organ- 
izations, but I view it as a great step forward for Intel to create 
and address them. Intel's next step is to put them in the context 
of business process and business unit needs. 



My own hypothesis is that the best way to segment knowl- 
edge workers would be by the roles they perform within the 
organization. I would guess that determining whether you're a 
"field sales analyst" or a "midlevel marketing manager" would 
drive the type of work you do and how it could be done more 
productively and effectively. Of course, that will be difficult 
and perhaps expensive. Most organizations don't even know 
how many roles they have. I suspea the only role-based seg- 
ments that might make sense are those in which there are many 
workers in a single segment, or in which better productivity or 
performance is mission-critical. 

A great example of such a role-based approach is at the global 
telecom company BT, which has focused 
considerable effort on its 15,000 cus- 
tomer contact workers. The focus for 
these workers was less on increased pro- 
ductivit)' (t\'pically measured in call-han- 
dling times) and more on improved 
customer service through better avail- 
ability of relevant information and 
knowledge. BT implemented a new role- 
specific portal, BT AdvisorSpace, within 
its customer contact centers. BPs goal is to make available all 
needed information and knowledge in real-time while the cus- 
tomer is on the phone — and eventually to bring the relevant 
information to the screen automatically based on the current 
customer transaction. Already the new system has led to a sev- 
eral percentage-point increase in customers feeling that their 
adviser was helpful and knowledgeable (it's at 97 percent now). 
The advisers' confidence in the information they use is up by 23 
percent. To me, that's a great example of what an organization 
can accomplish when it focuses its efforts and information 
resources on a particular role. 

Of course, there are important ways to improve productiv- 
ity that don't involve IT. One is to ensure that there are meas- 
ures of productivity and effectiveness in place (easy in call 
centers, harder with more autonomous knowledge workers). 
Another is to develop business process standards such as the 
Capability' Maturity Model I mentioned in my last column. A 
third is to treat every inter\'enrion into knowledge work as an 
experiment — with measures, a control group, clear hypotheses 
about the result and so forth. 

I'm more confident than ever about the importance — and 
the difficult)' — of addressing the topic of knowledge worker 
productivity. Just remember: It's the Next Big 
Thing, and you heard it here first. HH 



Tom Davenport (fdavenporti8>bat)son.edu) Is director 
of the Accenture Institute for Strategic Change and 
professor of IT and management at Babson College. 
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These days, you are your information. And having infornnation that's less than accurate is simply no longer 
acceptable. Yet with incompatible data sources and volume multiplying, how can you possibly bring all of 
your data together and come up with a timely and relevant assessment of your business you can trust? The 
answer is Informatica? We can transform your disparate enterprise data — re- 
gardless of source or application — into a single, manageable, and scalable 
resource that delivers business insight that is easy to use, reliable and auditable. 
To learn why over 80% of the Fortune 100 have turned to our unified data integration and business intel- 
ligence solution, just call 800-970-11 79, or visit us online at www.informatica.com. Because if you're only as 
good as your data, this is how to always be at your very best. 
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The Economy 

What's the outlook? What domestic and foreign 
policies are helping or hurting? And what about 
the hard-hit tech sector? 

Jobs & IT People 

What happens when all the baby boomers start 
retiring? Does the younger generation really look 
at work differently? Why is there so little diversity 
in the IT ranks? Is offshore outsourcing leading to 
the extinction of most domestic IT jobs? Are our 
schools adequately preparing the next generation 
of IT and business workers? 

Law & Society 

How are ClOs coping with the Patriot Acts, 
Sarbanes-Oxley, HIPAA, and other legal man- 
dates? What pending legislation is bound to 
give you headaches if it passes into law? How 




much security and privacy is enough? Is all the 
talk about ethics just that? Social responsibility: 
can business do well by also doing good 
—and do your customers care? 

Technology 

How worried should you be about vendor consoli- 
dation? What are the major cross-industry busi- 
ness concerns— and what solutions/initiatives are 
getting funded in the near term? Should you fear 
the RFIDs in your future? What emerging tech- 
nologies are venture capitalists betting their 
money on now— and why? 

Future of IT (& the CIO) 

For many years, ClOs have been working hard to 
secure a place at the top management table. Now 
some business and industry gurus say IT is no 
longer strategic: it's just becoming a commodity 
and can't give a competitive advantage. Are they 
right? Should ClOs be worried? 

And we'll give you plenty of networking opportunities, starting 
witti the CIO Golf Tournament on Sunday morning, receptions, 
special small working groups and breakouts, mealtimes, 
discussion roundtables, and evening hospitalities. 
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Wanted: Metric 

Skeptics 

Accepting vague or irrelevant numbers 
for project value measurements can lead to 
bad IT spending decisions 

I CONFESS. I'M A NUMBERS KIND OF GUY. But I'm concerned. I see 
too many numbers, with too little meaning, cavalierly factored 
into too many IT value discussions. Metrics are often manage- 
ment's single most important determinant of value. So allowing 
anything less than top quality numbers — and the correa con- 
text for these measurements — leads to wrong decisions about 
which IT investments to select, which implementation paths 
to choose or what portfolios to manage. 

There are three common ways that people misuse metrics: 
tolerating ambiguity, discouraging guesstimates and overlook- 
ing available sources. Let's take a look at some solutions for 
avoiding these missteps. 

Tolerating Ambiguity Numbers falsely convey a mystique 
of truth, by their very existence. But rarely do numbers actually 
mean what they seem to imply. That is because a metric is not 
"the result." It is shorthand for a story about the result. If the 
metric user leaves out the story portion of the metric, we are left 
to make potentially erroneous assumptions to fill in the gaps. 
For example, if someone states "we have a 25 percent cus- 
tomer retention rate," he is providing us with an ambiguous 




metric. Because the story behind the metric is missing, his mes- 
sage has no infallible meaning. In this example, a good metric 
story might say: "Our internal audit committee confirmed last 
April that our Southern division has experienced a 25 percent 
customer retention rate, for those customers who have bought 
at least $10,000 annually from us, for the past three years in a 
row. Sue Smith, vice president of finance, has stated that this 
retention rate is too low to allow us to realize the gross margin 
goals for this yean" Armed with that explanation, we are less ^ 
likely to misuse the metric's meaning and implications, and can < 
make an informed decision. J 
Discouraging Guesstimates Another misuse of numbers ^ 
occurs when management refuses to accept guesstimates z 

o 

(informed estimates) as legitimate metrics. This problem occurs 5 

a: 

whenever someone says, "If you can't prove it, we won't use ^ 
it." In this mistaken worldview, only hard metrics from fac- ^ 
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You did everything right faut... 




your IT spending isn't aligned with the business strategy, 

you've failed the company. 



Your job has moved beyond just technology — you 
need to embrace your company's overall business 
objectives. Primavera can help. For 20 years, we've 
been working toward the ultimate project portfolio 
management solution. 

Our software helps you prioritize your entire project 
portfolio, so you can optimize people, projects, and 
processes to stay focused on business goals. 



We saved a Fortune 100 company $1 5 million 
in nine months. How much can we save you? 

To estimate your company's potential savings with 
our convenient online ROI Calculator, visit: 
www.primavera.com/ppm 




PRIMAVERA 



Jack Keen I Real Value 



tual situations are valid. The clear message is that guesses don't 
count. The reality is that informed guesses are what makes the 
world work. If business investment strategies were 100 per- 
cent faa-based, we wouldn't need high-price executives to guide 
the company. Computers could probably do the job via fancy 
calculations. The whole discipline of risk management is ulti- 
mately grounded in probabilities, which themselves are esti- 
mates. The medical profession begins and ends with the 
reliability of doctor diagnoses, none of which are 100 percent 



Metrics are often management's single most important 
determinant of value. So allowing anything less than 
top quality numbers leads to wrong decisions about 
which IT investments to select. 



correct. But they get enough right that we don't ban their 
profession. A similar situation exists with our economy's 
reliance on meteorologists. They don't hit the mark 100 percent 
of the time. But their track record is good enough for airplanes 
to fly safely through troubling storms, not to mention properly 
attiring our families for school and work. The key to accepting 
informed guesses as valid metrics is to make sure they: A. Come 
from knowledgeable, experienced and dependable people; and 
B. Are accompanied by clear explanations of the guesstimate's 
premises, assumptions and logic. 

Overlooking Available Sources For many CIOs, the most 
distressing situation occurs with metric misuse when the really 
good, hard, relevant ones exist, but they go undiscovered. More 
often than not, this occurs from lack of elementary research 

skills by those charged with 
finding such metrics. In this 
age of information over- 
load, useful metrics, of 
direct validity for the com- 
pany's situation, may well 
exist, yet are hidden within 
readily accessible sources — 
such as the publications 
from trade associations, 
research by business 
schools and surveys from 
industry analysis firms, to 
name a few. Ironically, 
sometimes an organiza- 
tion's customers either have 
the missing metrics or 



Get Relevant Metrics 



Want metrics that are reli- 
able, easy to use and clear? 
Check out our online Metrics 
column. We run; 

• BRIEFS (Were your 
e-commerce sales among 
the nearly $12.5 billion in 
the second quarter of 
2003?) 

• FLASH CHARTS (Are you 
one of the 4 percent of 
CIOs who expect to 
decrease their IT staff in 
2003?) 

• REPORTS that go behind 
the numbers to the people 
who found the data in the 
first place. 

Go to www2.clo.com/metrics 

cio.com 



would be willing to set up a program to find them, but no one 
has asked them to do it. 

These are all metrics missteps that routinely derail projects or 
lead to costly and incorrect decisions. But using numbers correaly 
is a skill that can be learned. Read on for some specific advice on 
how to help your enterprise use numbers in more powerful ways. 

Five Steps to Ensure Reliable Metrics 

You can use several methods to make your staff and manage- 
ment aware of the pitfalls of mis- 
using numbers. Here are some ways 
to strengthen your organization's 
metric savvy-ness: 

Conduct Sensitivity Education 
Alert both management and staff to 
the promises and pitfalls of metric 
usage. Help them to become more 
sensitive to metric fumbles, as well 
as home runs. Assist hard-core 
numbers people in getting more comfortable with solid guessti- 
mates built on informed analysis. 

Apply the Metric Trustworthiness Test Apply this three-way 
test to all metrics: 1. Is the metric clearly defined and explained? 
2. Is the source of the metric visible and credible? 3. Is the met- 
tle's story readily available and relevant to our situation? Trust- 
worthy metrics score three out of three on this test. 

Actively Seek Industry and Vendor IHelp Identify industry 
trade associations, industry analysts and vendors that consis- 
tently pass the Metrics Trustworthiness test. Tell them what 
types of metrics you are looking fo^ then ask for their help in 
finding them. 

Do Internet Research Aggressively Find relevant metrics 
from studies by others. Tr>' searching the Internet, using key- 
words such as metrics and a topic. For example, a Google 
search using the keywords metrics and help desk brings a 
wealth of information for a help desk business case. 

Publish Internal Guidelines Publicize the organization's 
view concerning what types of metrics are valid, why and where 
to find them. 

Projecting a healthy skepticism toward numbers dealing with 
IT value can help turn metric disrespect into metric success. 
Like many good things in life, however, success at "metricifi- 
cation" requires a modicum of education, discipline and per- 
sistent follow-up. Fortunately, it's worth it. tSEJ 



Jack Keen is founder and president of the IT consultancy 
The Deciding Factor (www.decidingfactor.com) and 
coauthor of Making Technology /nvestments Profitable: 
ROI Road Map fo Better Business Cases. He can be 
reached at /ack.keeniScompuserve.com. 
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SONY. 




Any system can store data. 

You need to store content. 




Training video is content. Seismic studies are content. And so are CAT 
scan images. PDF files, audio clips and presentations. According to the 
analysts, an avalanche of content is about to land on top of your data center. 
Are you ready? With a Sony PetaSite' data tape library, you will be. 

Sony's PetaSite libraries extend beyond terabytes into petabytes— to 
keep abreast of your grow/ing storage needs. SAIT PetaSite libraries 
leverage the world's highest capacity data cartridge'— SAIT— to achieve 
the highest storage density. So you save precious data center space. SAIT 
also offers the lowest tape cost per gigabyte." So you save money. Or 
choose Sony's DTF-2 PetaSite libraries, which have lightning-fast loading 
and file access. So you also save time. 

Sony PetaSite libraries are ideal for backup, archiving and Hierarchical 
Storage Management. Sony PetaBack" and PetaServe'* solutions give 
you even greater flexibility. 

Sony PetaSite libraries. The Work Smart solution for storing content. 
Work Smart. Work Sony. 

'Source Storagv Afidlylici r»p« Fotmal fdcli. I/24A)3 
"Media compartson based on MSRPs ol SAIT. LTO, AIT .3 and SDLT nud-rangc lormats as featured in CDW, 1/23/03 



VISIT WWW.SONY.COM/DATASYSTEMS JR CALL 800-829-7669 FOR 
MORE INFORMATION ON SONY'S PetaSite SOLUTIONS. 
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3p Everyone wants Web services standards. 
CEOs think the technology will create new opportunities. 
CFOs believe it will save millions. 

Vendors see a pot of gold at the end of the Web services rainbow. 
And ClOs know that linking to customers and partners over the 
Internet will revolutionize both business and IT. 
So what's the holdup? 

The usual suspects: Politics. Ego. Suspicion. Fear Greed. 

BY CHRISTOPHER KOCH 



t's already a given: Your company is going to 
waste money on Web services. 

Research company Garmer predicts American business is 
going to squander $1 billion on misguided Web services proj- 
eas b)' 2007. Exacdy how much of that will come out of 
your pocket depends in part on how many confusing, over- 
lapping Web services standards emerge in the next few years. 

Riglit now, it looks like there's going to be a lot of them. 

The Web services standards process began to fall apart 
this year. No fewer than four organizations — Liberty 
Alliance, Oasis, W3C and WS-I — are vying to preside over 
the process, each with different goals, each with differing 
degrees of power and influence. 

And two opposing camps of vendors have emerged: an 
uneas>' alliance of IBM and Microsoft versus nearly every- 
one else. Both groups are busy duplicating each other's work. 



Both are proposing Web services specifica- 
tions — some proprietary, some not — with 
unclear patent and licensing implications for 
CIOs. In an arena as complex as Web serv- 
ices, confusion is not a good thing. But right 
now, that's the situation. 

The Web services vision is grand: a uni- 
versal set of communications protocols to 
enable computer systems and business 
processes to seek each other out over the 
Internet, lonely hearts style, and have deep, 
meaningful interactions with no human 
intervention. Even in today's rudimentary 
state, Web services standards such as simple 
object access protocol, or SOAP (see "Core 
Web Services Standards," Page 58, for the 
list of current standards), are proving to be 
valuable integration technologies. A Gart- 
ner survey of 110 companies found that 
54 percent are already working on Web 
services projects or have plans to begin soon, 
and IDC (a sister company to C/O's pub- 
lisher) estimates that companies will do 
$2.2 billion worth of Web services projeas 
in 2003 and $25 billion in 2008. 

"The potential revenue impact of these 
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standards is enormous," says Whit 
Andrews, research direaor for Gartner. But 
the ver>' size of that financial prize waiting 
for the winners of the Web services stan- 
dards competition makes it "difficult to 
remain involved in a standards effort that 
involves your competitoi;" he adds. Gartner 
goes so far as to predict that the alliance 
between IBM and Microsoft will break 
down by the end of this yean, given that the 
companies are direct competitors in the 
application server and database markets that 
make the biggest use of Web services. 

"That's silly," responds IBM spokesman 
Steven F.isenstadt. Steven VanRoekel, .Micro- 




soft's director of platform strategy, says, "I 
couldn't speculate on how long things will 
go [between Microsoft and IBM]." 

And what about the users? Where are the 
CIOs.' 

Some companies have gotten involved 
with the standards-setting organizations, 
including financial services heavyweights 
such as Fidelity Investments and J.P. Mor- 
gan Chase, as well as some forward-thinking 
manufacturers such as GM and health-care 
giant Kaiser Permanente. But tlie)' remain 
the niinorit>' in organizations that, by default, 
are ovenvhelmingly dominated by vendors. 

"CIOs haven't gotten involved because 




DAVID CHAPPELL 
Chief Technology Evangelist 
Sonic Software 

A member of the W3C 
working group, Chappell 
went to Redmond to view 
Web services specifications 
but then was told not to dis- 
cuss them with anyone else. 



it's a big time commitment, so they say. You 
vendors figure it out," says Eric Ausrvold, 
research director for AMR Research. 
"That's like putting the fox in charge of the 
henhouse." 

If CIOs continue to stand on the sidelines, 
they may very well end up with no chickens, 
forced to choose from among multiple Web 
services standards that may not interoperate, 
may have limited life spans, and may come 
with fees or other onerous patent and licens- 
ing requirements. 

And if so, CIOs can start ticking off their 
shares of that wasted $1 billion right now. 

FEAR OF FEES 

Contrary to the hype that surrounds 
Web services, there is no guarantee 
that the technology will continue to 
follow the path it has followed so far, which 
is that it is free and comes with limited 
restrictions. 

In fact, the free model for Web services 
already has been tested and has just barely 
survived. In the spring of 2002, just as stan- 
dards organization Oasis was about to rat- 
ify the specification for ebXML (electronic 
business using extensible markup language, 
designed to help companies transact busi- 
ness across borders and languages), IBM 
announced that it held patents for a piece of 
the specification and that it would offer it 
under a licensing model called Reasonable 
and Non-Discriminatory (RAND). If that 
had stood, vendors would have had the 
right to charge fees and apply usage restric- 
tions to individual users of the software on 
a case-by-case basis. But after other con- 
tributors to the specification, including the 
United Nations, claimed that IBM previ- 
ously had pledged that its work would be 
royalt\'-free, IBM issued a statement saying 
it would relinquish any rights to fees. "We 
were happy to clarify that we did not intend 
to charge a fee when we realized that some | 
of the industr)' was confused," says IBM S 
spokesman Eisenstadt. "We had never pro- | 
posed that we would charge a royalty; we > 

m 

were simply following the process as S 

o 

defined by the standards body." £ 
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You can't tell the organizations apart without one. Who's who, and what's what. 
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Both Eisenstadt and Microsoft's Van- 
Roekel say their companies will not charge 
royalties for the specifications that they 
offer to standards bodies. But both com- 
panies will continue to use RAND licensing 
for their specifications, which means that 
other restrictions could be placed on the 
use of the technology. 

Web services needs to be free of cost and 
other license restrictions if the industry and 
its customers are to adopt them on a broad 
enough scale to make interoperability a 
realit)', say standards believers. If the vision 
for Web services comes true, and compa- 
nies use these standards as they use HTTP 
and HTML — that is, constantly — then roy- 
alties on Web services could become like a 
toUbooth for business on the Internet, chip- 
ping money out of every transaction that 
crosses the wires. 

Worries about intellectual property led 
one standards organization, W3C (the 
World Wide Web Consortium), to adopt a 
policy that all specifications it ratifies into 



standards must be free of fees and other 
restrictions. In addition, companies sub- 
mitting specifications for consideration as 
standards must declare their licensing and 
patent intentions up front before the stan- 
dard comes to a vote. 

Critics say that has driven Microsoft and 
IBM into the arms of another standards 
organization, Oasis (Organization for the 
Advancement of Structured Information 
Standards), which has less rigorous require- 
ments regarding patent and royalt)' issues. 
"At Oasis, we do have a policy that allows 
for specifications to have patent claims," 
says Patrick Gannon, the organization's 
president and CEO. "The result is that over 
90 percent of the specifications from Oasis 
have no royalty related to them." 

But it's that last 10 percent that has peo- 
ple worried. Web services standards are like 
pieces in a puzzle: Most are dependent on 
other pieces to make a whole. If just one of 
the necessary pieces has royalties or restric- 
tions attached to it, the system is not free. 



WHY STANDARDS OVERLAP 

n June 2002, a vendor coalition led by 
Sun Microsystems wrote a specification 
called WSCI (Web Ser\-ices Choreography 
Interface, or Whiskey, in geek-speak). A few 
months later, IBM, Microsoft and a few 
other vendors offered up BPEI.4WS (Busi- 
ness Process Execution Language for Web 
Services), a specification that overlapped 
with WSCI. W3C formed the Web Services 
Choreography Working Group to consider 
the specifications. At the first meeting, a 
researcher from Microsoft showed up "to 
determine if he wanted to join the working 
group," says Microsoft's VanRoekel. 

David Chappell, Sonic Software's chief 
technology evangelist and a member of the 
W3C working group, remembers the meet- 
ing well. He says the representative from 
Microsoft and one from BEA Systems "were 
clear that there was this other BPEL initia- 
tive, and they said, 'The wishes of both 
Microsoft and BEA are that the group focus 
on things'that are complementary to BPEL 
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and not competing,"' recalls Chappell. "The 
response from the group was, 'We'll take 
that under advisement.' So Microsoft said, 
'We're not going to participate.'" The 
Microsoft representative never returned, 
although BEA continued to be a part of the 
group. IBM does not have a representative in 
the group. 

Microsoft's VanRoekel says the researcher 
made the decision whether to join the group 
meeting as an individual, "independent of 
him being a member of the Web services 
group at Microsoft." But the damage had 
been done. Some vendors, most notably Ora- 
cle and Sun, took it as a snub and a signal 
that IBM and Microsoft were going to go 
their own way on Web services. 

Indeed, Microsoft and IBM took their 
BPEL specification (which each had been 
working on for years and had embedded 
into their produas) to Oasis and formed a 
committee to begin working on a standard. 
Responding to complaints about potential 
confusion and duplication. Oasis and W3C 
established liaisons to coordinate work 
between the two groups to try to avoid 
overlap. 

As of this writing, they're still working 
at it. 

OASIS VERSUS W3C: 
TITANS CLASH BY PROXY 

If there's a driving force behind the grow- 
ing competition between Oasis and W3C, 
it's less the organizations themselves than 
it is their predominantly vendor member- 
ship. They're split into two major camps: 
IBM and Microsoft on one side and Sun and 
(usually) Oracle on the other, with smaller 
vendors trailing in the wake of both. IBM 
and Microsoft worked together to build the 
first major Web services spiecification, SOAP, 
that they offered to W3C for consideration 
in 2000 (W3C later modified and ratified it 
as a standard in June 2003). In April 2001, 
IBM and Microsoft submitted a road map 
to W3C of the specifications that they 
believed needed to be added in and around 
SOAP to fill out the Web services stack, as it 
is known. 



IBM and Microsoft have followed that 
road map ever since, publishing 20 different 
specifications for Web services. Critics say 
the plan is both an impressive technological 
vision. ..and a rationale for excluding other 
vendors — and even the standards organiza- 
tions — from the process. Of the 20 specifi- 
cations, only two have been submitted to any 
standards organization for consideration. 
Critics charge that the others are being held 
back while the two companies work to per- 
fect them and build them into their products, 
thereby giving them an advantage in the 
market. 

"If you look at the pattern of behavior 
that's been established by Microsoft and 
IBM, it's clear that they want to create spec- 
ifications in a vacuum without input and 
hold them close to the vest while they 
develop them in their products and then 
release them to the standards organizations," 
says Ed Julson, group manager of Web serv- 
ices standards and technology for Sun. 



Core Web 

Services 

Standards 



XML (extensible markup language) 
The lingua franca of Web services. 
All Web services can communicate 
in XML. 

SOAP (simple object access proto- 
col) A communications protocol for 
Web services. 

WSDL (Web services description 
language) An XML-based language 
for describing, finding and using 
Web services. 

UDDi (universal description, discov- 
ery and integration) A phone direc- 
tory for Web services ttiat lists 
available Web services from differ- 
ent companies, their descriptions 
and instructions for using them. 



"We've worked together with industry 
partners to be sure that the standards 
process starts with a well-defined proposal," 
responds IBM's Eiscnstadt. 

When Microsoft and IBM do offer up 
their specifications for input, critics say, it's 
usually behind closed doors rather than in 
the open forum of a standards meeting. 
Sonic's Chappell recalls being invited to 
Microsoft's headquarters in Redmond to 
view two Web services specifications. "IBM 
and Microsoft were being hammered for 
going off and doing their own thing," he 
says, "so this was viewed as a way of open- 
ing things up." But Chappell says he had to 
sign an agreement saying he would not dis- 
cuss the specifications with anyone else and 
that anything he contributed to the devel- 
opment would become the intellectual 
property of the companies writing the 
specifications. 

Microsoft's VanRoekel says his company 
does not require visiting vendors to sign 
nondisclosure agreements. "You're welcome 
to talk about what's going on," he says. But 
he says Microsoft does make them sign a 
feedback agreement that stipulates that "if 
you come and offer input on this technol- 
ogy, then that Input must be made available 
royalty-free." He adds that Microsoft plans 
to publish results of vendor feedback ses- 
sions on a public website this fall. 

Critics say Microsoft and IBM's strategy 
of writing specifications outside of the stan- 
dards groups limits give-and-take. "It's turn- 
ing into a proxy war where Microsoft and 
IBM are coming up with what they feel will 
be the standards and shopping them around 
to see who will rubber-stamp them," says 
an official from a standards group who 
requested anonymity. "If one won't take it, 
they take it to the other. They're playing 
W3C and Oasis off against each other." 

Last January, another conflict broke out 
between the two vendor camps, this time 
within Oasis. After a coalition of vendors 
led by Sun, Oracle and Sonic submitted a 
specification to ensure reliable delivery of 
messages (called Web Services Reliability) 
and formed a committee, Microsoft and 
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IBM published their own specification called 
WSReliabilit\', which has not yet been sub- 
mitted to any standards organization. 

Microsoft's VanRoekel says his company 
is simply following the road map it submit- 
ted to W3C. "The reason we take this 
approach is to make sure the specifications 
are well-engineered, have a fast time to mar- 
ket and have something we call compos- 
ability, which means they work well with 
the other pieces out there," he says. "What 
has npically happened in the standards bod- 
ies where you design by committee is that 
the end product is so open for loosely inter- 
preted implementation that you end up not 
having technology that will work with other 
pieces that have been developed out in the 
industry." 

END RUN AROUND THE 
STANDARDS BODIES 

In February 2002, Microsoft and IBM, 
along with seven other vendors, founded 
the Web Ser\'ices Interoperability Orga- 
nization, or WS-I (famously excluding Sun 
from the group's board at first, but later 
allowing it to join). WS-I is not a standards 
organization per se, but it combines differ- 
ent Web services pieces in an installation- 
ready package. It calls these packages of 
Web services "profiles," and offers tools 
and guidelines for installing them. The first 
profile, called the Basic Profile, was released 
last August. 

"[WS-I is] a supra-standards body that 
ratifies which of these standards will be the 
baseline for Web services," says Dan 
ShoUer, vice president and director of tech- 
nology research services at Meta Group. 

The problem, critics say, is that WS-I can 
pick and choose the pieces it wants to 
include in the profiles. "With WS-I, 
Microsoft and IBM have set up a shadow 
government for standards," charges Susy 
Struble, program manager of Web standards 
and technologies for Sun. 

The first profile, for example, contains 
versions of SOAP and WSDI. (Web services 
description language) that were never rati- 
fied as standards bv W3C but are included 
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in Microsoft and IBM products. But W3C 
has approved versions of SOAP and WSDL 
that have been modified from the versions 
contained in the WS-I profile. That means 
CIOs are being presented with two different 
versions of the core standards for Web 
services. 

"These standards are always evolving," 
says Microsoft's VanRoekel, who is a mem- 
ber of the marketing committee for WS-I. 
"W3C ratified SOAP late in the process of 
putting together the first profile. [The W3C 
standard version] will be incorporated into 
the next profile." IBM's Eisenstadt agrees, 
adding, "These versions of SOAP and 
WSDL have the broad industry adoption 




f 



that is needed." 

But what if competing standards come 
out of W3C and Oasis? 

"Multiple proposals indicate lots of inter- 
est — it's not evil," says IBM's Eisenstadt. 
"The market should decide which proposals 
are best. Interoperability is the whole point 
of Web services, so single standards will 
emerge." 

Adds VanRoekel, "WS-I will take a look 
at what customers are implementing and 
decide [which standard to include in a pro- 
file] based on that." He encourages those 
with concerns about the process to join 
WS-I. "IBM and Microsoft aren't the only 
members of WS-I," he says. "We don't 
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decide what the WS-I does." 

Indeed, Microsoft and IBM are not 
alone in contributing to the confusion. Sun 
has cofounded its own standards group. 
Liberty Alliance, to develop a Web services 
standard for identity- management that uses 
SAML (security assertion markup lan- 
guage), an Oasis securit\' standard. 
(Microsoft and IBM have released a speci- 
fication called WS-Securiry that, according 
to Sai Allavarpu, group manager of Sun 
One Network Identity, treads near the 
same turf.) 

But with their combined market clout, 
Microsoft and IBM have the power to push 



their own specifications and ignore others 
to death. A: least that's what AMR's 
.Austvold predicts will happen to the WSCl 
business process specification now before 
W3C. "That's going to be dead within 
24 months," he says. 

"Can you have a standard without 
Microsoft's and IBM's participation?" asks 
.Meta Group's Sholler. "Yes." But if that 
standard does not appear on the Windows 
platform, which commands upward of 
95 percent of the I'C market in the United 
States, and does not appear in IB.M's Unix 
and mainframe platforms, will anyone use 
it? he asks. 
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the door. But unfortunately 
the agendas that form these 
groups don't allow that. 
Dig deep enough into the 
woodpiles of these standardil. 
organizations, and you'll 
always find a vendor as the 
mommy or daddy." 




WHY CANT WE ALL JUST GET 
ALONG? 

Microsoft and IBM have invested a 
good deal of marketing money — 
and a lot of good technology — into 
Web services to build the perception in the 
market that they are making it happen. 
Other vendors want their customers to think 
the same of them. 

"I am not sanguine about there being a 
successful outcome for Web services because 
it looks to me like there is an increasing like- 
lihood of fragmentation and confusion in the 
market rather than a convergence," says 
Don Deutsch, vice president of standards 
strategy and architecture for Oracle. "We go 
into a standards endeavor with the objective 
of defining things of common interest that 
will create a new market, or improve an 
existing market, so we can all comjjete on 
price and performance. If there are some 
members who don't believe they can partic- 
ipate on an equal basis, then historically the 
competition begins and fragmentation 
begins. That confuses customers, and when 
customers are confused, they don't buy 
because they don't know what to buy." 

Ironically, if the alliance between IBM and 
Microsoft breaks down, things could get 
even worse. If the two leading vendors in 
Web services were to begin sending compet- 
ing specifications to the different standards 
organizations for approval, forget about 
attaining a single set of interoperable stan- 
dards soon, if ever. Regardless of what ball- 
pens between IBM and Microsoft, howevet, 
as long as vendors remain split and standards 
organizations continue to allow conflicting 
work inside their organizations, the Web 
services standards movement will continue 
to be disrupted by confusion, delay and the 
possibility of duplicate, conflicting standards 
emerging. For CIOs, that could translate into 
slow, expensive, dead-end projeas at a time 
when Web services could be saving them 
time and money in a tough economy. 

"One of the things that would be nice is 
if this alphabet soup of standards groups 
would get together and say we're all about 
delivering a single standard," says Dave 
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Watson, vice president and CTO of Kaiser 
Permanente, which is active in WS-I. "I'd 
love to get everyone to say there's one set of 
standards and collapse at least four different 
discussions into one and keep overt agen- 
das at the door; because you don't serve cus- 
tomers that way. But | unfortunately] the 
agendas that form these groups [don't allow 
that). Dig deep enough into the woodpiles of 
these standards organizations, and you'll 
always find a vendor as the mommy or 
daddy." 

THE BUSINESS OF STANDARDS 
IS BUSINESS 

If there is a force that can keep the Web 
services standards movement from blow- 
ing up, it is CIOs. But few CIOs have the 



vendors feed them." 

Besides the obvious bandwidth issues, 
many CIOs say that with the shift to pack- 
aged software in their organizations, they 
don't have the technical expertise to con- 
tribute much to standards organizations. But 
in fact, that's not where CIOs are most 
needed, says Sun's Struble: "CIOs should be 
involved in the early requirements phase, the 
part where we define what we want the 
standard to do." 

Indeed, those CIOs who have gotten 
involved in standards organizations have 
done so to make sure that what emerges is 
right for their businesses. "We can put our 
requirements on the table and have a dia- 
logue," says Andrew Comas, who, as vice 
president of technology, is J. P. Morgan 



Web services model. For GM, the issue is 
the OnStar communications network it's 
building into its cars and trucks. 

But the link between Web services stan- 
dards and business goes even deeper for 
these companies. The sooner they know 
where the standards are going, the sooner 
they can begin shaping their architecture to 
take advantage of Web services faster than 
their competitors can. 

"We take these public standards and add 
in our own standards and pass that down 
into the organization," says Adrian Kunzle, 
who is cohead of the architecture group at 
J. P. Morgan Chase's investment banking 
division. "Our participation in standards 
groups comes from the fact that we're up 
front about creating an architeaure strat- 



"If you need what this standards activity is producing 

and you choose not to play at some level, then you can't complain about the 

product you receive." -Kaiser permanente CTO Dave Watson 



interest or resources to participate in the dif- 
ferent standards organizations. About 30 
percent of Oasis's membership comes from 
user companies, according to Gannon, 
though the number of user members who 
are active members of the different technical 
committees is much smaller. The number of 
members in each of W3C's four different 
Web services working groups who do not 
sell or service technolog)' does not rise above 
10 percent, and in most cases can be 
counted on one hand (most of the groups 
have about 50 members). At WS-I, the user 
company membership is less than 10 [per- 
cent. Liberty Alliance's user membership is 
just under 30 percent. 

"The structure of these groups is back- 
ward," says AMR's Ausrvold. "The users 
should be the ones creating the standards, 
and the vendors [should be| adopting them. 
Right now, users have to take what the 



Chase's representative at WS-I. "If I'm not at 
the table, then I'm having the vendors say 
what's best for us." 

The companies that are involved connect 
the work they do in the standards organi- 
zations to their core businesses. J. P. Mor- 
gan Chase and Fidelity Investments are 
concerned about the speed of online trans- 
actions and the quality of products pre- 
sented to customers over the Internet. 
Kaiser Permanente cares about the move- 
ment of online health-care transactions 
standards known as HL7 from EDI to a 



Share Your Opinion 



Do you become part of the standards story, or 
wait It out on the sidehnes? Are Web 
services the next new thing or the newest 
headache? Whatever your take on Web serv- 
ices, post your thoughts at ADD A COMMENT 
on the online version of this article 

cio.com 



egy for our organization. We want to 
understand where they are going early so 
we can plan." 

Of course, the commitment required to 
participate in the development of technical 
standards is considerable. These efforts can 
go on for years. "On a topic you're inter- 
ested in, it's easily a couple of hours a 
week," says Bill Stangel, enterprise archi- 
tea for Fidelity. He says Fidelit>' has a dozen 
or so staffers involved part-time with vari- 
ous technical committees in standards 
organizations. Other companies have simi- 
lar stories: part-time participation of any- 
where from six to 10 staffers. Not a bad 
investment, they say, considering the insight 
it gives them. 

"Without awareness of what's going on 
with standards, it's game over," says Tony 
Scott, CTO for GM, which is actively 
involved in Liberty Alliance. "That aware- 
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ness allows my organization to provide 
guidance to the wider IT organization inside 
GM about where they should be placing 
investment. What's emerging, what's chang- 
ing, what's obsolete." 

For companies that cannot afford to get 
involved directly, Scott recommends they 
try to exert influence with their vendors. 
"We have a lot of clout, obviously," says 
Scott. "We actively engage the R&D com- 
munity in areas that we think are impor- 
tant. If we start asking a lot of questions 
about a particular technology or standard, 
they get the message." 

Finally, say these technology executives, 
it's important to vote for standards and 
interoperabilit)' with your checkbook. "TTie 
theme of interoperability is not going to go 
away," says Kaiser Permanente's Watson, 
saying he wouldn't buy a product if it 
"complicated the interoperability issue." 

Standards are inextricably linked to the 
future of business through the Internet. 
That they are floundering today means 
business will flounder tomorrow. 

"Standards are the basis of competition 
going forward," says GM's Scott. "It's not 
just your ability to make and sell that mat- 
ters anymore. We used to have a 48-month 
product development cycle; now we're 
down to 18 months, and we're trying to 
get to a year. When you have that kind of 
rapid change, you have to have architec- 
tures and standards and interoperabilit)'. If 
you can set the standard or drive the stan- 
dard, that enables you to get to market 
faster and have a broader market than 
might have ever been the case prior to 
today. Think of standards as an accelerator 
to your business." 

But you can't affect those standards if 
you don't get involved, says Kaiser Perma- 
nente's Watson. "If you need what this stan- 
dards activity is producing and you choose 
not to play at some level," he says, "then 
you can't complain about the product you 
receive." HH 

Send feedback via e-mail to Executive Editor 
Cfiristopher Kocli at ckoch§>cio.com. 




Many companies are jumping into 
Web services before standards emerge. 
Sure, there are risks. Here's how some 
early adopters are managing them. 



otorola has 

committed to the enterprisewide deployment of Web services, 
with the hill knowledge and backing of Samir Desai, senior vice 
president and CIO. 

Never mind that Web services is still an emerging set of com- 
munications protocols that most vendors do not full\^ support. 

Never mind that the fulfillment of the Web services promise to 
simplify integration depends on standards that today are the sul> 
jea of rancorous debate by competing vendors and standards 
organizations. (See "The Battle for Web Services," Page 54.) 

Never mind that if an enterprise such as Motorola bets on 
standards that are eventuallv abandoned, its dream of commu- 
nicating cheaply and efficiently with customers and suppliers 
would mm into a nighmiare of expensive changes and upgrades. 

After two years of ever-expanding pilots at Motorola, the 
business benefits of converting hundreds of applications into 
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Web services and updating the company's 
underlying IT architecture to support them 
are, according to Desai, obvious and irre- 
sistible. 

"This is about increasing the throughput, 
agility and cost-eftectiveness of IT," says 
Desai. "How many times should I code a 
credit card check? With Web services the 
answer is one. In the past no one really 
knew the answer, but it was a much, much 
larger number." Merely by automating stan- 
dard transactions, Web services promises to 
save a huge amount of effort and money. 

This fall, Desai and his team will place 
bets on a cadre of vendors to supply the plat- 
form and tools for a multimillion-dollar 
effort to develop and operate Web serv ices, 
both internally and outside the firewall. And 
as Desai acknowledges, no matter the antic- 
ipated ROI, it's still a gamble. 

If standards fail to evolve, then the whole 
r effort is cast into doubt. "No Web services 
^ standards means no enterprise Web services. 
~ It's that important," Desai says. Adds Toby 
Redshaw, Motorola's corporate vice presi- 
dent of strategy, architecmre and e-business, 

www.c/o.com • OCTOBER 1. 2003 CIO 65 

Cu|- , 



Special Report Web Services The Early Adopters 



"If you back the wrong vendors and the 
market evolves past you, the vendors go out 
of business and the whole learning relation- 
ship, the whole [return on| investment sort 
of goes close to zero." 

That's just one risk among many. But 
diverse companies are rolling out Web serv- 
ices in defiance of these and other risks, 
looking for early mover advantage, ROI 
projected in the millions, and huge cost sav- 
ings over developing and deploying soft- 
ware in conventional ways. In a survey that 
the Cutter Consortium consultancy con- 



ducted earlier this year of 250 clients, 
13 percent said they were already using 
Web services for business-critical applica- 
tions as of last January, while 54 percent 
said they were developing or prototyping 
Web services applications. 

Early adopters are betting that by invest- 
ing in multiple standards, performing extra 
due diligence on vendors and keeping a 
long-term outlook, the effort will be worth 
it. Here's how three very different organi- 
zations — Motorola, the U.S. Navy and 
Wells Fargo — are addressing five major 
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risks of Web services in their deployment 
strategies. 

RISK NO. 1: Web services Isn't secure. 
MITIGATION: Choose a standard, but be 
prepared to switch. 

Any plan to expose data and applica- 
tions beyond the corporate firewall 
carries risk. Web services adds an 
extra dose of complexity to a company's IS 
strategy' because there are no agreed-on stan- 
dards for authenticating users and control- 
ling access to Web sen ices applications that 
are accessed from outside the corporate fire- 
wall. So far, that's deterred many organiza- 
tions from pursuing one of Web services' 
grandest promises: that trading partners 
could assemble application components they 
need to use at the time of each transaction. 
For instance, a builder could use one Web 
service to query catalogs from multiple sup- 
pliers, and another one to generate purchase 
orders to send to two of them. Upon receiv- 
ing the purchase orders, one supplier could 
use a Web service to access an internal data- 
base and confirm that the order comes from 
a customer in good standing. The other 
could use a Web scr\'ice provided by a third 
party to run a credit check. The software to 
run each transaction could be reused multi- 
ple times without additional programming. 
But each of those transactions requires a 
means to verify that the customer is who she 
says she is, and that she's authorized to do 
business. 

Secure verification hasn't arrived yet, but 
early adopters have learned that with plan- 
ning, it's possible to get around that prob- 
lem. Wells Fargo's Wholesale Banking unit is 
rewriting 35 online banking applications for 
corporate customers as Web services. The 
applications, now available through the 
bank's Commercial Electronic Office portal, 
will be broken up into their discrete com- 
ponents so that customers can pick and 
choose the features they want to use without 
having to open entire applications to per- 
form individual tasks. For instance, a com- 
pany treasurer who wants to make an 
investment could check her account bal- 



It's difficult to have short-term metrics for Web services. 

At the corporate level, Wells Fargo looks for ROI in the progress made toward 
sharing customer information among different business units and improve- 
ments in levels of service provided to customers. 



ances, create a wire transfer, and conduct a 
trade without having to open and click 
through three different applications. 

The bank has addressed the security 
conundrum by maintaining its existing 
methods for customers who want to access 
its Commercial Electronic Office and trans- 
mit data. Customers have to first establish a 
business relationship with the bank and 
obtain a user ID and credentials before they 
can use any online services. Those proce- 
dures don't have to change for the bank to 
make Web services available to customers, 
says Danny Peltz, senior vice president of 
Wells Fargo's Wholesale Internet Solutions 
Group. 

The major security challenge Peltz faces — 
keeping track of which transactions each 
user is authorized to perform — has less to 
do with protecting systems and data from 
unauthorized access than it does with main- 
taining systems' performance. As each appli- 
cation is currently designed, authorizations 
are verified when a customer launches the 
application. Because in the future customers 
will access Web services instead of launching 
an application, "the authorization has to 
travel with Web services," notes Peltz. "You 
don't want to have thousands of calls to a 
database each time there's an authorization 
change." Peltz says he expects to choose an 
industry standard for managing permissions, 
but observes "there's no clear road map for 
how to do it." 

It's possible that no standard will address 
his needs adequately. But Peltz has built 
into his strategy the time and money to 
evaluate different options. His first deploy- 
ment, at the end of this year, will be a new 
portal server that supports access to Web 



services applications through the Commer- 
cial Electronic Office portal. Then he'll roll 
out the actual Web services every quarter 
through mid-2005. "We're not going to 
tackle everything all at once," he says. 

The Navy, meanwhile, has decided to 
adopt security assertions markup language 
(SAML), an emerging standard that sup- 
ports authentication and authorization of 
end users. As a member of the Oasis stan- 
dards body, the Navy has been involved in 
the development of SAML. "Based on 
what we know, we think that's a good 
choice," says Monica Shephard, director 
of command, control, communications, 
computer and combat systems for the 
Navy's Atlantic Fleet. Because Navy per- 
sonnel are stationed around the globe and 
support contractors require access to both 
classified and unclassified information, 
Shephard says a standard sign-on capabil- 
ity managed as a reusable Web service is 
essential to ensure that everyone who 
needs access gets it. And that those who 
don't, don't. 

If the market takes a different tack and 
the Navy decides to change protocols, Shep- 
hard would follow change management 
policies set out by the Navy's CIO, David 
Wennegren. To facilitate technical changes, 
the Navy has spent about $1 million to 
develop what it calls a "portal conneaor," 
a middleware layer that lets the Navy sub- 
stitute standards or data definitions with- 
out forcing changes to user services or to 
underlying databases. Shephard has already 
been through one forced technology 
change — the choice to adopt new portal 
software, made by managers of the Navy's 
enterprise network, the Navy Marine Corps 



intranet. With that experience behind her, 
she is confident that she can change Web 
services standards successfully, if need be. 

R I SK NO. 2: The lack of standards 
breeds complexity. 
MITIGATION: Support multiple 
standards for now. 

The users of my information and my 
services and my architectures are fre- 
quently disconnected, often have 
extremely small bandwidth, and have to do 
business in real-time with organizations that 
are dispersed globally," says the Navy's 
Shephard. A big benefit of Web services is 
that those disparate groups — whether a 
land-based command center or a battle- 
ship — can easily access centrally managed 
data. But there's no consistent way to deliver 
that information through the many propri- 
etary portal platforms Navy users have 
deployed. 

A standard called Web services for 
remote portals would provide a common 
way to plug Web services into any portal, 
but it's still under development by Oasis. 
As part of the Navy's coping strategy, it's 
using its market power (the Navy spends 
$1 billion a year on its intranet alone) and 
influence with standards organizations to 
cajole vendors into supporting as many of 
the emerging standards as possible. The 
Navy calls its stratcg)' "vendor neutralit)'" 
because it presumes infrastructure vendors 
will eventually provide products that will 
work with any standard and therefore will 
be easy to integrate. 

"It's a difficult strategy for the short 
term, and the most powerful strategy for 
the long term," says Shephard. In the short 
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term, Shephard's staff has to put extra effort 
into making Web services work in a non- 
standard environment and keep up with 
technical details. The alternative — picking 
a few software products that every Navy 
unit would use — would ultimately be a 
more difficult strategy to execute, says Shep- 
hard, because it would risk getting stuck 
with proprietary sofhvare. "Then we would 
be tied to a single view change and a single 
company's ability to generate new and 
inventive ideas," she adds. In the meantime, 
the .Navy is using its portal connector to 
facilitate integration between Web services 
and proprietary applications. 



For Motorola's Redshaw, that strategy of 
covering your bases with multiple standards 
extends to the choice bcrsvccn .Microsoft's 
.Net and Sun Microsystems' J2EE as devel- 
opment platforms for Web services appli- 
cations. In his view, there isn't really a 
choice: Most companies, he thinks, will 
have to invest in both, as Motorola has. 
"It's strategically dangerous to go down one 
path or another," says Redshaw. .Most 
established companies already use J2EE, he 
notes, but "if you say, I don't like 
Microsoft, and get stuck in stupid politics, 
you may get leapfrogged." 

While it's hard to know exactly how 



much it's going to cost companies that 
maintain both platforms, Tom Welsh, senior 
consultant with Caitter, says to plan for pur- 
chasing software and servers to support 
both environments, as well as staffing up 
with trained programmers. "Few people are 
dynamic enough to be conversant in both 
.Net and J2EE," notes Welsh. It's also nec- 
essary to accoimt for the cost of managing 
and maintaining the two platforms. Yes, 
those costs add up, but as Welsh says, "It's 
a mistake to hope for the benefits of IT 
when you grudge the time, money and 
sheer effort necessary to understand what 
it's all about." 



How to Build Securely on Shifting Sand 

Five best practices for successful Web services projects 



1 Pilot, pilot, pilot (and plan 
to screw up). 
If you haven't been experi- 
menting with Web services In 
the past two years, don't rush 
headlong Into an enterprise 
deployment. "If there is one 
single factor that can help you 
minimize your risk. It's under- 
standing what you're doing," 
says Tom Welsh, senior consult- 
ant with the Cutter Consortium 
consultancy. "There are tre- 
mendous amounts of people 
running into production with 
things they don't understand." 

Toby Redshaw, corporate 
vice president of IT strategy, 
architecture and e-buslness for 
Motorola, advises doing multi- 
ple prototypes to see where 
Web services offers the greatest 
bang for the buck— and making 
sure everyone knows some 
tests might fail. "I have a pilot 
that's an absolute disaster," he 
says. "Occasionally, we're going 
to have blowups like that." 



2 Focus on architecture. 
"You'd never let anyone 
build a house without a 
blueprint," observes Redshaw, 
and by the same token, you 
need a service-oriented archi- 
tecture, which is designed to 
facilitate connection of soft- 
ware components, to deploy 
Web services most effectively. 

As with many infrastructure 
investments, the ROI Isn't read- 
ily apparent. "In the past 
20 years, IT was built to last, 
but In the next 10 years, the 
goal Is building IT to change," 
says Brand Niemann, a com- 
puter scientist who heads the 
federal CIO Council's XML Web 
Services Working Group. "You 
won't see the cost savings [of a 
service-oriented architecture] 
initially, but in the long run, It's 
cheaper and creates a more 
agile organization." 



3 Remember that nothing 
Is set in stone. 
Standards are fluid, soft- 
ware Is maturing, and the Web 
services you deploy now may 
have to be rewritten sometime 
in the future. "You're guessing 
the benefits outweigh the cost 
of recoding," says Whit 
Andrews, research director 
with Gartner. 

4 Involve the business. 
Every Web service is a 
component of a busi- 
ness process. Monica Shep- 
hard, director of command, 
control, communications, com- 
puter and combat systems with 
the Navy's Atlantic Fleet, has 
business managers decide 
which applications to convert 
to Web services and which 
legacy applications to kill. 
Some legacy systems will die a 
natural death, she says, but 
"sometimes the right thing to 
do Is wait" until users have 



time to revamp their business 
processes to accommodate the 
new environment. 

5 Communicate with your 
IT team. 
By Its nature, Web serv- 
ices Is interdependent, and 
unless all your software devel- 
opers are subscribing to the 
same programming principles, 
you'll end up with a mess of 
systems that won't interoper- 
ate. For instance, everyone 
should use the same protocols 
and access databases the same 
way, says Danny Peltz, senior 
vice president of Wells Fargo's 
Wholesale Internet Solutions 
Group. Educating developers 
about new data and communi- 
cations protocols is being 
handled by Wells Fargo's 
Enterprise Architecture Group 
through published documents, 
brown bag lunches and the 
existing process for reviewing 
new software. -E.V. 
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Special Report Web Services The Early Adopters 



RISK NO. 3: Vendors might go out of 
business. 

MITIGATION: Look past a vendor's 
software to its management. 

As with any emerging technology, not 
all of the software you need can be 
purchased from well-established 
vendors. There's a risk that you could 
choose a vendor that goes under or a prod- 
uct line that doesn't survive. 

"Theoretically, you'd say you have to let 
this space mature, you have to let the rate of 
change amongst the vendors slow down, 
and you have a much higher chance of pick- 
ing the right choices," says Motorola's Red- 
shaw. "It's nice, safe, probably a good 
approach for some companies. But if you're 
using old 'me too' technology, someone who 
is several steps ahead of you may have com- 




petitive advantage." Redshaw is willing to 
accept, as the premium Motorola pays for 
being an early adopter, the possibility that 
some of the vendors he picks may not 
survive. 

To mitigate that risk, Redshaw recom- 
mends that companies look past the capa- 
bilities vendors offer in their current 
products and condua due diligence on their 
R&D plans. "The tricky part is to look 
under the covers, to see what their underly- 
ing architecture is," he says. "We're trying to 
pick the horse that's going to win 20 races 
over the next two seasons." 

To this end, Redshaw scrutinizes the ven- 
dor's middle management. "Who's running 
R&D? If those guys really get it, I have a 
more comfortable feeling," he says. By this 
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test, the major software vendors probably 
understand Web services technology best, 
even if their products aren't mature. Work- 
ing with companies that aren't well estab- 
lished also requires some extra effort. "You 
have to really play a partner, if not 'big 
brother' role," adds Desai. "In many cases 
where we think it is strategic to IT, we 
become an owner as well as a customer." 

Howevei; there are some risks Redshaw 
isn't willing to take. A vendor's lack of atten- 
tion to security, he says, "is a deal-breaker." 
Vendors must address how they plan to 
maintain security as their software passes 
data to another vendor's application. "If you 
have a serious enough gap there, you just 
walk away," he says. 

Whit Andrews, research direaor at Gart- 
ner, adds that a critical factor in the choice 
of vendors should be whether they are driv- 



ing the development of standards "or being 
driven by them." He advises picking ven- 
dors that have a financial stake in the out- 
come of the standards battles. 



RISK NO. 4: Adoption by partners Is 
unpredictable. 

MITIGATION: Deploy robust middleware 
that can translate a variety of formats. 

f you build a Web services application, 
will anyone use it? That's a risk you take 
when you develop a process that's meant 
to be used by a trading partner. It's one thing 
to adopt new technology yourself — another 
to exjjcct customers and suppliers to make 
the same investments. And when you rely 
on trading partners to supply Web services 
that are critical to some business process. 



the potential points of failure are multiplied. 
The vision of Web services as a way trading 
partners could "discover" and use externally 
published components has generated a lot 
of hype, but it's far from reality. Neverthe- 
less, early adopters anticipate benefits to 
using Web services with external partners. 
The key: Don't rely on anyone else to supply 
any Web services you need to execute a 
transaction. 

Wells Fargo learned from its experience 
in rolling out its Internet applications that 
customers "don't care about the technol- 
ogy," says Steve Ellis, who heads the Whole- 
sale Banking unit, as long as the bank 
provides reliable and convenient service. So 
he and Peltz see little need to push customers 
to adopt simple object access protocol for 
sending XML messages, or even to send 
XML messages at all. Instead, the bank will 



accept messages in any format and convert 
them to XML for use by the Web services 
that apply EAI tools. 

"We see this as one of a suite of formats," 
says Ellis. "How people connect, we expea 
that to evolve over time. We have 30,000- 
plus companies we work with with differ- 
ent expertise and skill sets." Donie L(X"han, 
vice president with the Cap Gemini Ernst &c 
Young Financial Services Consulting Group, 
says Wells Fargo 's strategy will be a com- 
mon one as Web services is offered exter- 
nally. "There's a large cost to develop 
common middleware across an enterprise," 
says Lochan. "But if you didn't have that, 
you would need to go and rewrite a lot of 
the mainframe applications that you have 
to expose them securely." 



Diverse companies are rolling out Web services in 

defiance of the risks, looking for early mover advantage, ROI projected in 
the millions, and huge cost savings over developing and deploying software 
in conventional ways. Early adopters are betting that by investing in multiple 
standards, performing extra due diligence on vendors and keeping a long- 
term outlook, the effort will be worth it. 
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Special Report Web Services The Early Adopters 



It's also necessary to think hard about 
how to maintain systems' performance 
when Web services applications interact with 
each other, says William Wood, executive 
vice president for enterprise business serv- 
ices and information management with 
Wells Fargo's IT organization, Wells Fargo 
Services Co. "To manage end-to-end avail- 
ability, you're only as strong as the weakest 
link, so capacity and performance planning 
and really understanding what service lev- 
els are provided needs to be a very big 
focus," says Wood, who oversees Web serv- 
ices investments at the enterprise level. That's 
easier to do yourself than if you're depend- 
ing on external trading partners to provide 
Web ser\'ices. 

RISK NO. 5: No evidence yet for 
enterprise ROI. 

MITIGATION: Think long term. 

While evidence is emerging that 
companies already have realized 
benefits from their investments in 
Web services, enterprise-level ROI is still 
largely theoretical. Leading organizations 
currently report their gains in terms of the 
time and money saved on application devel- 
opment, says Cap Gemini's Lochan. Such 
savings can be impressive — the Navy 
lopped more than $8 million a year from 
the cost to manage just one operation plan- 
ning application as a Web service, and can 
now develop new applications in a few 
months instead of years. The Navy also 
reports improvements in strategic processes 
such as mission planning due to Web serv- 
ices that, for instance, enable the aggrega- 
tion and centralization of mission-critical 
weather reports. 

While it's taken a year and a half to whit- 



Talk to Samir Desai ' 



The senior vice president and CIO of 
Motorola has plunged into the fray with | 
an enterprisewide deployment of Web 
services. How's it going so far? What has he 
learned? Just how does one deploy Web 
services? Through Oct. 15. you can ASK THE 
SOURCE as Samir Desai answers your ques- 
tions on Web services. Go to www.cio.com/ask. 
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tie 100,000 applications down to 6,000 
Web services, Shephard anticipates it will 
take several more years to reach her ulti- 
mate goal of a few hundred Web services. 
Because technological change is driven by 
fundamental changes in how the Navy 
operates, the business value of Web services 
is dependent on how commanders execute 
their mandates to collaborate more closely. 
Getting top Navy leaders to buy into the 
potential of Web services was one of Shep- 
hard's biggest challenges. "We may have 
disagreements [now] about whether a par- 
ticular effort takes advantage of Web serv- 
ices in the best way possible, but we're not 
arguing about whether (Web services) is 
pertinent to the U.S. Navy," she says. 

Wells Fargo's Wood notes that "it's diffi- 
cult to have short-term metrics" for Web 
services. Wells Fargo doesn't even maintain 
a separate budget for its Web services 
investments, instead incorporating them 
into its IT architecture budget. At the cor- 
porate level. Wood looks for ROI in the 
progress made toward sharing customer 
information among different business units 
and improvements in levels of service pro- 
vided to customers. When ir comes to 
specific projects, Peltz says he'll keep invest- 
ments under control by developing new 
services in short, iterative cycles rather than 
sinking a lot of money into big projects. 
And he'll tackle first the projects that cus- 
tomers want the most — services like event 
messaging (customized notifications about 
payments received or other financial events) 
and payment transactions. 

Becoming an early adopter of Web serv- 
ices is not an easy road. "Most cultural 
change programs fail. Most strategic change 
programs fail. Most large IT programs fail 
or underperform," says Motorola's Desai. 
"Aggressively adopting Web services at the 
enterprise level is all three combined. So the 
most critical decision is to see how not doing 
this can be competitively dangerous." tSEi 

If you're an early adopter tell Senior Editor Elana 
Varon about your experiences. You can reach her 
via e-mail at evaroni^'cio.com. 
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Post-Implementation Audits 




UNTIL YOU DO THE POST- 
IMPLEMENTATION AUDIT 

Scrutinizing every aspect of a finished project and 
acting on the lessons learned can be controversial 
and difficult. But post-implementation audits are an 
important way to avoid repeating costly mistakes. 

BY MERIDITH LEVINSON „ , 

Reader ROI 

► Why post-implementation 
audits are valuable 

► Learn from companies 
doing it right 

► Overcome resistance to 
PIAs in your organization 
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soon as Michael Baker Corp.'s IT department finished installing a 
^^^L ^^^k Web-based procurement system from ePlus, Bruce Higgins, CIO of 
the $405 million engineering and construction company, was bom- 
barded with inquiries from colleagues about the system's effectiveness. He had 
ample anecdotal evidence suggesting that orders were getting turned around more 
quickly, but he didn't have tangible proof that the system was improving efficiency. 

So he decided to conduct his first ever post-implementation audit (PIA) of the new 
system. A PIA is a top-to-bottom evaluation of the hard and soft benefits derived 
from a strategic information system, the security of that system and the 
project management process for deploying it. From the PIA, Higgins 
learned that liecause IT miscalculated the number of people needing to use 
the new system, the ROI was driven down by the cost of ordering addi- 
tional licenses. The PIA also showed that the system was saving the com- 
pany more than $ 1 50,000 yearly, however, so Higgins was able to prove 
the system's worth to his colleagues. And he learned some valuable lessons 
on what not to do on subsequent projects. 

CIOs would do well to follow Higgins' lead in realizing that a PIA is 
a worthwhile way to prove the value of IT. But many don't. In fact, Bar- 
bara Gomolski, a research director with Gartner, estimates that a mere 
20 percent of companies take the time to condua PIAs. 

Companies avoid post-implementation audits for many reasons: They 
take too much time and drain away valuable personnel resources — two 
things currently in short supply. They require reams of documentation so 
that processes and results can be validated. Finally, project sponsors and 




Bruce Higgins, CIO for 
Michaei Baiter Corp., 
says that post-imple- 
mentation audits help 
him prove a system's 
value. They also yield 
lessons for the next 
project. 



implementers fear that the results of an audit, 
if unfavorable, will he used against them. 

The CIOs at companies successfully per- 
forming audits have identified critical suc- 
cess factors, including: getting the right 
people involved, riming the audit properly, 
and collecting enough documentation to 
facilitate the smooth execution of a PIA. 
They pick the right projects to audit (for 
more information on this, see "How to 
Select the Right Project for Your First 
Post-Implementation Audit" at 
www.cio.com/printlinks). And 
these CIOs share several key 
traits on how they ensure that 
I'lAs become a sustained prac- 
tice in their organizations: They 
are all committed to continuous 
improvement, they've made 
PIAs a part of their projea man- 
agement methodologies, and 
they have their CEOs' support. 
But companies not jx'rform- 
ing PIAs are missing out on 
the important benefits such 
data provides. Although the 
challenges and risks associated 
with PIAs seem formidable, 
66 percent of this year's CIO 
100 honorees always or fre- 
quently conduct them, accord- 
ing to a C/O survey. Since the 
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Post-Implementation Audits 




According to Jim Smitli, CiO of Sun Life Financial, post-implementation audits give IT a 
valualile tool for Iwlplng business units understand wliere ttieir dollars are lieing spent. 



honorees were chosen for their exceptional 
resourcefulness, their prevalent use of the 
audit establishes it as a best practice among 
highly effective organizations. PIAs provide 
a thorough approach for proving the value 
of high-cost, mission-critical IT investments 
and for gleaning projea management best 
practices, which CIOs can then apply to 
keep subsequent projects on track. At a time 
when the value of CIOs, IT departments and 
rr investments are under increased scrutiny, 
PIAs are now more critical to CIOs' success 
and survival than ever before. "With the 
pressure on business today and the respon- 
sibility of IT to help the business units 



understand where their dollars are being 
spent, I really have trouble with anyone say- 
ing you shouldn't be doing [PIAs] in this 
[hard economic] time," says Jim Smith, CIO 
of Sun Life Financial and a strong advocate 
of PIAs. 

How to Overcome 
Resistance to Audits 

Many CIOs and their IT organiza- 
tions shy away from audits 
because they think they'll be 
scapegoated if the audit reveals problems or 
lack of ROI. That's why Michael Barilla, 
vice president for business information serv- 



ices of Greif, a $1.6 billion manufacturer of 
industrial and paper packaging, frequently 
reminds himself and his IT staff that systems 
implementations and software deployments 
are not IT projeas, but business projects. So 
if a project fails, he says, "it's going to fail as 
a team," and everyone — not just IT — will 
be accountable. 

Gartner's Gomolski concurs. If an audit 
exposes a shortcoming, she says, that prob- 
lem shouldn't only reflea on IT, especially if 
the project was jointly sponsored by the 
business, IT and finance. 

"Exposing problems can be a double- 
edged sword," says Gomolski. "But it's bet- 
ter to be proactive. If you haven't achieved 
the value you thought you would, figure out 
what you can do to change that." 

Another common concern about PIAs 
shared by CIOs, IT employees and even 
businesspeople is that they suck up too 
much time and require too much toil. But 
companies that perform PIAs say they 
shouldn't — and don't — take a lot of time to 
execute. Honeywell Aerospace aims to 
spend no more than seven to 10 days con- 
ducting an audit, and Sun Life Financial tries 
to complete PIAs within rwo weeks. 

Furthermore, CIOs who conduct PIAs 
say the time and resources audits use get 
recouped on subsequent project implemen- 
tations. Resistance to audits also often stems 
from a desire to be rid of a project once the 
deployment is complete and to move on to 
the next challenge. The trick is to make it 
easy for workers to conduct and provide 
feedback for PIAs. For example, when Sun 
Life Financial's IT project office needs to 
solicit feedback on a system from business 
users, it asks them to fill out an elearonic 
survey, on their own time, that takes no 
more than 20 minutes to complete. The 
response rate for those surveys is usually bet- 
ter than 50 percent and is sometimes close to 
100 percent, says Ed Esposito, director of 
the project office. 

Because Honeywell Aerospace's IT organ- 
ization for its Aviation Aftermarket Services 
unit also has trouble reengaging business 
users in a project during an audit, the IT 
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organization leverages its staffers who have 
completed training in Six Sigma, a process 
improvement methodology. Those with Six 
Sigma training, who are experts in business 
processes, provide the IT department with 
the feedback it needs to determine whether 
a system has streamlined workflows. 

Engage the Right People 

Who should f)erform PIAs is a mat- 
ter of great debate. The most 
common groups of workers 
include one or more of the following. 

■ Members of the project implementation 
team from IT 

■ Members of the project implementation 
team from both IT and the business 

■ Representatives from a company's internal 
audit department 

At Sun Life Financial, IT's project office 
leads the PIA process on its own IT and 
non-IT projects. But it does so in conjunc- 



It's better to have a group of people from 
different functions participate in the audit 
rather than just an IT team. 



tion with the finance department and the 
company's internal audit department. IT 
projects are audited from the beginning and 
on an ongoing basis, rather than at the end 
of an implementation, which ensures that 
IT follows sound project methodologies, 
meets user requirements, stays on budget 
and implements proper security controls. 

Sun Life Financial's approach comes clos- 
est to being the best, according to PIA 
experts. Don Christian, a partner with Price- 
waterhouseCoopers, says the PIA team 
should consist of a businessperson and an 
IT person who were involved with the 
implementation, and that it should be led 



by someone independent, such as an internal 
auditor, who was not part of the project 
team. Christian says it's better to have a 
group of people from different functions 
participate, rather than just an IT team or 
just internal audit because they all provide 
valuable input. The advantage of having 
members of the IT project team involved is 
that they're intimately familiar with the ben- 
efits, deliverables and requirements of the 
projea. And because they know the projea 
so well, it is easier for them to fully evaluate 
a project. Having a businessperson on the 
audit team is important because she can 
more easily determine if an external factor 
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Post-Implementation Audits 



rather than a systems failure is causing a sys- 
tem to not generate expected value. And an 
independent auditor is important because 
he's not afraid to ask tough questions and 
will prevent the members of the project team 
who are involved in the audit from softening 
any findings. 

Time It Right 

When to conduct an audit, just as 
who should lead it, is a matter of 
debate. When to start depends 
on the type of system or application 
deployed, the amount of time it will take 
before the application begins generating 
some results or data, and the amount of 
time it takes staffers to get acclimated to 
the new system and new processes. Gen- 
erally the audit should take place well 
within a year of implementation. 

"When wc started the audit a month 
after the implementation, we didn't have 



"Exposing problems can be a double-edged 
sword. But it's better to be proactive. 
If you haven't achieved the value you thought 
you would, figure out what you can do to 
change that." 



enough data to see if the system was suc- 
cessful or not," says Michael Baker Corp.'s 
Higgins. "It's really important to make sure 
the system is up and running long enough 
to have enough data in the system that you 
can analyze." 

Ken Cunneen, IT leader for technology 
and integrated supply chain systems in Hon- 
eywell Aerospace's Aviation Aftermarket 
Services division, says if a company imple- 
ments a financial system that only gives 



-Barbara Gomolski. research director Gartner 



results once a quarter, the audit team should 
wait at least three to six months until the 
system has generated enough data before 
performing a PIA. 

On the other hand, the sooner you start 
the audit, the fresher the data and the easier 
it is to cull lessons learned. Which is why 
PIAs should not be a onetime event, says 
PWC's Christian. 

Sun Life Financial's project office begins 
PIAs within a month of project completion 
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Eight Steps for a 
Successful PIA 



ILong before the post-implemen- 
tation audit (PIA) begins, write up 
a clear business case that delineates 
and breal^s down the cost of the 
project, the soft and hard benefits, 
the expected ROI. and when the ROI 
will be fully achieved. 

2 Keep scrupulous records of al I 
the changes that are made to the 
system and to the project plan during 
the implementation. A Web-based 
version control or collaboration tool 
can make this easier. 

3 Identify the members of the 
audit team. 

4 Schedule a kick-off PIA meeting 
to identify all the logistics that 
need to take place to perform the 
audit. 

5 Review the business case, the 
initial scope of work and all the 
change orders. Around the same time, 
schedule interviews with users or 
send out satisfaction surveys. Also 
survey implementation team mem- 
bers to find out how well they think the 
various project objectives were met. 
Test the system and its controls. 
Examine the quality of the data. Take a 
sample of the transactions to make 
sure they're being processed the way 
they should. Engage the finance 
department to conduct its review of 
the system's payoff. 

6 Compare audit findings with the 
business case to see if you hit 
your target. 

7 Gather lessons learned Identify 
what went well, what didn't and 
why. Determine how you can address 
what didn't go well in future imple- 
mentations. 



8 



Perform follow-up reviews. 

if necessary. -M.L. 



to do a postmortem on the implementation 
process and to get feedback from users to 
make enhancements to the system. "When 
we have benefits that are realized over a 
period of years after the project is imple- 
mented, we do follow-up reviews," says Sun 
Life Financial's Esposito. 

Higgins plans to take that iterative 
approach with Michael Baker Corp.'s ERP 
implementation, which is scheduled to be 
completed by the end of this year. "We will 
begin to audit the effectiveness of the new 
system within a couple of months after we 
finish implementing it," says Higgins. 
"Then we'll probably start to look at the 
ROI six to eight months after we go live 
so that we have enough data to perform a 
good analysis." 

Maintain Meticulous 
Documentation 

Another key to successful PIAs is 
good documentation, which takes 
many forms. It includes the busi- 
ness case that outlines the system's expected 
cost, benefits and ROI; the project's time 
line, including key metrics and milestones; 
a breakdown of the system's technical 
requirements; a record of the security and 
financial controls that have been put inside 
the system; and a compendium of all the 
changes that have been made to the system 
or project plan. But getting good docu- 
mentation is one of the biggest challenges 
CIOs and IT departments face in conduct- 
ing PIAs, particularly if they're doing one 
for the first time. 

Sharon L. Thompson, director of IT 
audit for the AARP, says that if an auditor 
discovers that the implementation team 
does not have a thorough business case, a 
detailed project time line or meticulous 
records of changes and security controls, 
the auditor should note that discovery in 
the audit report and include a recommen- 
dation for the implementation team to keep 
better records. 

To make life easier for himself and his 
post-implementation auditors, Higgins uses 
a Web-based collaboration tool called 



MPOWR — developed by members of his IT 
department to do version control and to 
archive changes made to the project's scope, 
templates, time line and budget. When it 
comes time to do a PIA, Higgins sends the 
auditors a link to the MPOWR site with a 
user name and password. 

Sun Life Financial's IT project office also 
developed a project portfolio management 
system in-house that the projea manager 
uses to report on a monthly basis changes 
to a project's cost, milestones and schedule. 

Act on Lessons Learned 

If you don't use PIAs to identif)' ways to 
improve project management, you're not 
realizing their full value. Sun Life Finan- 
cial's Esposito says project team members 
who served on the audit and implementa- 
tion teams hold a meeting during the PIA 
process to discuss what went well and what 
went wrong both during the implementa- 
tion and the audit, and to identify areas for 
improvement. 

To ensure that people take these lessons 
to heart. Sun Life Financial posts them on 
the corporate intranet and submits to senior 
management a summary of findings from 
PIAs of all projects done during the course 
of the year. Esposito also makes changes to 
project management and implementation 
processes if a project's PIA indicates that 
changes are warranted. 

Sun Life Financial annually reviews the 
audits of different projects to identify com- 
mon areas that need improvement. Gart- 
ner's Gomolski says it's important to do 
this type of project-to-project comparison. 
"The real value," she says, "is in seeing 



Learn More About PIAs 



Looking for the backup to prove IT value? 
Look online for NAILING THE POST-IMPLE- 
MENTATION AUDIT, which includes a: 

• BUSINESS CASE PROCESS with flow charts 

• PIA SCORECARD for planning 
■ PIA SUMMARY of major steps 

Plus additional resources: "How to Select the 
Right Proiect for Your First PIA" and "Doing It 
Right: Questions to Ask Dunng an Audit." Find 
It all on the online version of this article or at 
www.clo.ca m/printlinks. 

clo.com 
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some of the patterns. For example, 'We 
screw up every time we do an integration 
project. What does that mean?' Or, 'Every 
time we do a project with this business 
unit, we suffer from amazing scope creep 
because they don't really know what they 
want, so maybe we have to work with 
them differently.'" 

Sustain the Momentum 

Now that you're armed with con- 
vincing arguments on the impor- 
tance of PIAs and success factors 
for pulling them off, making them a sus- 
tained practice in your organization should 
look less daunting. 

"If you have the project's objectives, 
approach, how it's going to be organized, 
how the business areas are involved in the 
project, the expeaed costs, and the antici- 
pated hard and soft benefits well-defined 
up front, and you manage change along the 



"If you have the project's objectives, 
approach, how the business areas are 
involved in the project, the expected costs, 
and the anticipated benefits well-defined 
up front, then when you come in to do the 
post-project audit, there are no surprises." 



-Ed Esposito, director of Sun Life Finaricial's IT project office 



way, then when you come in to do the 
post-project audit, there are no surprises," 
says Esposito. 

Not only do PIAs go smoother when 
you've done all the hard work on the front 
end, but you increase your odds of actualiz- 
ing the system's value. "By getting a better 



understanding of project costs up front," 
says Higgins, "you'll be more likely to hit 
the ROI you're trying to meet." QEl 

Are you afraid of post-implementation audits? Tell 
Senior Writer Meridith Levinson via e-mail at 
mlevinson@cio.com. 



5) Scream 
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Music on demand. More and more people have moved from buying 
CDs to downloading the songs they want to hear, when they want them. 
On demand is changing the way consumers — and entire industries — act. 

1993 One guy in Omaha downloads "Swanee River." 
1999 Digitized music + Internet = Napster. Industry roiled. 
2003 Millions download music, paying 99 cents a song. 



The iPod'": New technology 
and new business model meet. 
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A guide to the on demand world: The big picture 



Yes, I'm sure on demand is 
very, very, very, very important. 

What is it again? 

It's an on demand world. When did it happen? Who pushed the "on" button 
in on demand? Did we just wake up one morning to an on demand world? 



It's been coming for some time. Business and technology continue to merge. E-business 
keeps driving ever higher levels of customer expectations and cutting-edge delivery on those 
expectations. Pressure to deliver instantly is reaching a critical mass in most industries, a 
tipping point, where on demand becomes the norm. 

What is on demand? To a consumer, it means you can buy a song online in the middle of the 
night. Rent a video right on your TV set. Get what you want, when you want it. For companies, 
it means your processes are integrated — not just internally, but with partners, vendors, 
suppliers, and of course, customers. So when opportunity knocks, you can answer. 



The more often people get things on demand (whether it's music and videos or cars and 
retirement plans), the more they expect that capability from you. Or your competitor. It's 
one big connected world, driven by demand. Are you ready for it? 



Can you see it? it's an on demand world. A world where the 




line between business and technology is fast disappearing. IBM 




is uniquely positioned to help you get there, with everything from 




high-level business model analysis to deep industry knowledge 
to implementation capabilities. So you can act — and react — fast. 


ibm.com/ondemand 


On demand business. Get there with (© business on demand'" 
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Just when she thought she knew everything, this IT veteran spent 
some time on the btisiness side. What she learned there prepared 
her to take over as Fanners' CIO when opportunity knocked. 

BY ALICE DRAGOON 



JAN FRANKLIN WAS 17 WHEN SHE UNDED MR nRST JOB AT FARMERS INSURANCE AS A KEYPUNCH OPERATOR 

on the 4 p.m. to midnight shift. Within two years, the driven college student got herself promoted to 
a programming job, launching her steady ascent up die FT ranks. I^-£orwanl to 2001, and Franklin 
had become vice president of FT appiicaticMis and developmott, overseeing a $300 million budget as 
IT chief operating officer. At that point, she knew prem' much evePithing 
there was to know about IT at Farmers, having done most of it herself. 

But Franklin had the good sense to know what die lacked: direct 
business experience. So she ventured outside die realm of rr to ask then 
Executive Vice President of Propert>' and Casualn' Stephen Leaman to 
be her mentoi: When he suggested a tour of duty on die front lines of the 
business to round out her experience, she readily agreed. So Leaman 
put a bug in CEO Martin Feinstein's eac Having served as QO himself 



Reader ROI 

► How time on the business 
side can benefit you 

Recognize the value of 

listening to your users 

► Realize the importance of 
looking beyond metrics 
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in the early '90s, Feinstein understood that 
letting Franklin broaden her horizons would 
make her a more valuable employee — and 
knew that IT would benefit from having a 
scout on the business side. Franklin would 
be able to identify opportunities to apply IT 
strategically and get a chance to view IT 
from a user s viewpoint. When the business- 
side position of executive direaor of the Los 
Angeles Service Center (LASC) became 
available in September 2001, Leaman called 
Franklin in London, where she was cele- 
brating her 10th wedding anniversary. Was 
she interested.' Absolutely. Three weeks later, 
she found herself heading up one of Farm- 
ers' largest service centers — leading a staff 
of 550 who do underwriting and provide 
administrative support for up to 5,000 
agents who sell Farmers insurance. 

The lessons Franklin would learn in the 
trenches not only made her a more savvy 
businesswoman but also gave her an appre- 
ciation for how customers of IT really use 
technology. Those lessons serve her well 
today because, as fate would have it, the 
CIO spot did open up in March 2003, when 
Cecilia Claudio left to head up IT for 
Europe, Asia and Africa for Farmers' par- 
ent company, Zurich Financial Services. And 
when Franklin got tapped to fill it, she was 



more than ready. Here she shares four les- 
sons that she learned on the other side of 
the fence. 



Take the Time 
to Walk the Floor 
and Listen 




FRANKLIN WAS ALWAYS KNOWN AS A 

no-nonsense, bottom-line manager with lit- 
tle patience for office politics or excuses — 
and often little patience for listening. She 
had so much experience that she could aa 
quickly and decisively. Markus Nordlin, vice 
president of IT strategic projects, recalls that 
after a short time of listening to a problem, 
she'd say, "You guys are idiots. This is the 
way it's going to be." While she always did 
this with her tongue planted firmly in cheek, 
says Nordlin, her good-natured conversation- 
stopping technique did have the desired 
effect of, well, stopping conversations. 

But when Franklin got to LASC, she had 
no choice but to learn. She was charged with 
supporting the agents, with whom she had 
not worked direaly and over whom she had 
minimal control since they weren't on the 
payroll. In Franklin's second week on the 
job, she realized she had to get herself up to 



The Softer Side of Jan Franklin 

A stint on the business side taught Farmers' CIO about 
the importance of building relationships 



WHEN JAN FRANKLIN got called back to the home office to become CIO of Farmers 
Insurance (as well as the local CIO for the North American consumer business 
of Farmers' parent company, Zurich Financial Services), her direct reports at the 
Los Angeles Service Center (LASC) made up "I Survived Jan" T-shirts. But they also 
gave her roses and attached a lesson she'd taught them to each flower "She was the 
hardest person I ever worked for." says Mary Monesi, accounting manager at LASC. 
"But she taught us. She made us look for results." Franklin carves out time to mentor 
her employees, holding regular leadership meetings to discuss the latest 
management theory or walk through a financial statement. Attendance is optional, 
but the meetings are always packed. Morale is also important to Franklin, who 
gamely sat in the dunking booth at a carnival she organized for agents and threw an 
employee appreciation picnic for 500 in the LASC parking lot. Monesi says of 
working for Franklin: "She made me a better person." .^■■■^^ -A.D. 



speed, so she set aside every Friday to meet 
with at least two district managers and as 
many agents as she could, ''i was right in 
front of agents to hear what they thought 
of our systems, of the products we produce, 
and what their issues and concerns were." 
And soon, the listening paid off: Agents 
started calling to let her know that certain 
processes were not working properly or to 
ask her to do something about a form, for 
example, that had been typed in 1 972 and 
was still being photocopied and sent to 
clients with handwritten annotations. Talk- 
ing directly to agents "helped me in running 
the service center," she says. "It also helped 
me understand how building these relation- 
ships was something I should continue to 
do wherever I was." 

Franklin learned so much on her Friday 
road trips that she suddenly understood the 
value of talking to the people on the front 
lines. "It was a shock to me how much [my 
job at LASC] was relationship-building as 
opposed to just fixing bugs," she says. Now 
that she's CIO, Franklin schedules time to 
walk the floor because she realizes it's the 
best way to connect with employees. 

Getting the IT staffers in the habit of reg- 
ularly listening to their business counterparts 
is also a new priority for Franklin. Instead of 
focusing just on YTs two primary customers 
(the heads of personal and commercial 
lines), Franklin and her IT team created a 
relationship manager program. She assigned 
one of her staff to most of IT's 30 key busi- 
ness partners and brought in trainers to 
build their consulting skills. Relationship 
managers meet monthly with their business 
partners to discuss business issues and 
opportunities to apply IT. With this program 
in place, the business managers now have 
an easy way of communicating with IT and 
getting what they need. 

Franklin and her team also developed a 
solution provider program, whereby IT 
staffers with advanced skills are assigned to 
help business units address specific needs. If 
a relationship manager sees an opportunit>' 
to use IT strategically (say, to streamline 
accounting reports), a solution provider 
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Not with us it isn't. 



We see management 
a little differently 
from the other guys. 



At NetlQ, we don't see a problem. Only solutions. 
Managing your Windows server environment is easier 
than ever with Microsoft Operations Manager. And, 
as a key Microsoft partner, NetlQ extends Microsoft 
Operations Manager to manage and secure your 
entire enterprise, whether you're driving UNIX, 
NetWare, Linux, Windows.. .or all of them. NetlQ. 
We're the management people. And nobody does 
management smarter. Nobody. 

CIO eBook! Get your free copy of From Chaos to Control: 
The ClO's Executive Guide to l\/lanaging and Securing 
the Enterprise, www.netiq.com/manageability. 
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team is called in to help. Team members 
work on the project on their own rime but 
get an opportunity to develop their skill sets. 
And IT benefits by building a more experi- 
enced staff (and by not having to shell out 
money for outside consultants). 



Lesson 


IT Metrics^^^(Ji 


9 


Can Help the 


/ 


Business Too 



AS AN I.T. VETERAN, FRANKLIN THINKS 

in terms of metrics, process, discipline. But 
at LASC, she found "less rigor, not a lot of 
metrics or process documentation. It was all 
in people's heads. It was a culture shock." In 
fact, when she first walked into the Simi Val- 



seven days. "It took us six months to get 
relatively accurate with it," she says. "But 
even just by starting to measure, there were 
improvements." Under Franklin's watch, 
service levels improved more than 20 per- 
cent. "It was just rigor," she says. "Me tak- 
ing what we typically do in IT — process, 
metrics, discipline, rigor — and applying 
exactly the same things." 

For an IT pro like Franklin, automating 
the LASC was a bit like Tiger Woods play- 
ing a round of miniature golf. Franklin 
managed to reduce costs by more than 
10 percent overall by implementing an elec- 
tronic fax management system, loading 
paper commission reports into Excel, imag- 
ing paper files, investing in PCs and sending 
e-mail bulletins instead of paper flyers to 



'In the service center, you see 
the impact of the IT error. That 
was the big 'aha.'" 



ley service center, she might have been step- 
ping back in time. A vast sea of decades-old 
Steelcase desks awash in paper stretched out 
over four floors, each the size of a football 
field, and green-screen terminals topped 
most of the desks. Most processes were 
paper-based and hadn't changed in 20 years; 
hardly anyone used e-mail. Franklin quickly 
realized she had a rare opportunity to cut 
costs and improve efficiency dramatically by 
eliminating or automating non-value-added 
tasks. She simply needed to introduce the 
rigor and metrics of IT along with some 
basic, low-cost technology. 

A math major in college and a self-pro- 
fessed metrics manic. Franklin worked with 
the LASC staff to figure out what to meas- 
ure. While the concept of measuring took 
some getting used to for some employees, 
they came up with specific goals, such as to 
answer 80 percent of calls within 20 sec- 
onds and get 90 percent of the work out in 



-Jan Franklin, CIO, Farmers Insurance 

the agents. Faaoring in savings by consol- 
idating accounting and commercial-loss- 
control staff for all of California into 
LASC, she saved a total of $3.3 million 
during her tenure. 



Lesson 


Metrics Don't 


Q 


Always Tell the 


O 


Whole Story 



the erroi; how they have to deal with cus- 
tomers and do rework to fix it. That was 
the big 'aha.'" But because some mistakes 
are inevitable, she's instituted clean-up 
processes to mitigate the impaa to the serv- 
ice centers. This fact hasn't escaped the 
CEO's notice. "Jan is much more sensitive 
when something goes bump in the night 
than she might have been previously 
because she had to experience the other end 
of it," says Feinstein. "She knows what it 
does to the business." 

Franklin's firsthand experience also gives 
her a better sense of how agents will 
respond to the eAgent portal that IT 
recently rolled out — and helps her put the 
systems' metrics in context for her staff. 
Whereas she might once have overestimated 
the importance of a metric, such as 
average transaction time, to gauge a 
system's success, she now knows to 
delve deeper. "You guys don't get it," 
she'll say to her staff. "Average trans- 
actions aren't what agents are feel- 
ing. I was in an agent's office, and it 
took over a minute for that transac- 
tion to complete. It's just too slow 
out there, and they're not going to 
use it." If agents revert to their green-screen 
terminals instead of using the portal, they 
won't get real-time alerts when customers 
are about to cancel or haven't made their 
payments. And all the work that IT put into 
developing the system won't matter. 



WHILE METRICS YIELDED IMPRESSIVE 

results at LASC, Franklin also realized that 
they don't always tell the whole story. Her 
tenure on the business side gave her an 
opportunity to feel the pain of a system hic- 
cup in real life. "When you sit here in IT 
and an error occurs, you say, well, that 
error affected 5,000 out of the million or 
so transactions we processed yesterday. Big 
deal. It's less than half a percent," she says. 
"In the service center, you see the impact of 



Lesson 


Coaches Get 


/ 


Better Results Than 
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Drill Sergeants 



FRANKLIN'S COMMAND-AND-CONTROL 

management style had always served her 
well in IT. And when she got to LASC, she 
soon had reason to apply it. Within a 
month of her arrival, Franklin was hearing 
repeated complaints from agents about one 
of her functional areas. Calls weren't being 
answered promptly, documents weren't get- 
ting out on time, forms were lost, and 
claims were mispaid. Franklin attacked the 
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problem with her tried-and-true militaristic 
approach. "I sat down with staff members 
and said we would have it fixed by this 
date, come hell or high water," she recalls. 
Within three months, they'd addressed 
many of the service problems, but a staff 
survey also revealed that morale was horri- 
ble. Franklin realized that to sustain the 
improvements and to make further 
progress, she'd need to shift to a participa- 
tive management style. So she gathered the 
troops and explained why she handled the 
problem the way she did: She'd wanted to 



Leadership 

say she's a better listener. "Before, she'd just 
cut you off, saying, 'You don't get what I 
mean.' Now she'll listen to you go through 
your little diatribe of why things are the way 
they are," says James Fridenberg, vice pres- 
ident of IT applications and development. 

Recalling Franklin's pre-LASC days, 
Nordlin says, "when a situadon would arise, 
Jan would listen real quick to understand it, 
make a decision, and off she'd go. She was 
comfortable doing that and generally was 
right." But given the same circumstance 
today, "she is much more likely to call in 



"Now Jan is much more 
likely to consider 
individuals' input before 
making a decision." 

-Markus Nordlin, VP of IT, Farmers Insurance 



turn the organization around quickly. The 
staff then told her it would have been easier 
to take if she'd explained what she was 
doing up front. Franklin got the message 
and switched into collaborative gear, put- 
ting the ball in their court to suggest and 
sustain further improvements. Employee 
morale improved, says Franklin, and in a 
survey of agents some six months later, this 
functional area was rated one of the better 
groups at LASC. 

These days. Franklin rarely calls on her 
command-and-control tactics. Her reports 
say that her style is collaborative, and she's 
more likely to coach than dictate. They also 



Learn More About Leadership 



Jan Franklin's school of hard knocks Is one way to 
cut your leadership teeth, Anotlier is to check out our 
LEADERSHIP & MANAGEMENT RESEARCH CENTER 
for the latest survey information and related features 
from CIO and its partners. Go to www.cto.com/ 
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the various parties, hear various sides of the 
story, and consider individuals' input before 
making a decision." 

From Feinstein's point of view, Franklin's 
stint on the front lines allows her to bring 
more value to the table as a senior execu- 
tive at Farmers. "Jan can now provide 
greater insight and advice as to where wc 
should focus our attention," he says. "She 
has the ability to step back and say, 'Let me 
share with you where you're going to get 
the advantage.' I think that's something she's 
been able to learn as a result of being on 
both sides." 

Now that she's on the IT side of the fence, 
it's a standing joke with her staff that she's 
no longer allowed to say, "When I was in 
the service center...." But, of course. Franklin 
does regularly draw on those experiences, 
and she's a better CIO for it. BH 



Senior Editor Alice Dragoon can be reached at 
ac(ragoon@clo.com. 
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Sound Off 

Taking Sides on Critical IT Issues 



Should 
Software 
Vulnerabilities 
Be Posted 
Online? 



JEFF JONES, SENIOR DIRECTOR of Microsoft's Trustworthy Com- 
puting security initiative, was quoted in late July in an Associ- 
ated Press article making a statement that seems at first to be 
the understatement of the year. Referring to the online publi- 
cation of code that could help hackers take advantage of a 
recently discovered flaw in most versions of Windows operat- 
ing systems, Jones said, "We continue to believe that publica- 
tion of exploit code in cases like this is not good for customers." 

Jones's conviction that giving hackers the key to the castle 
was not good for those of us who live inside the castle seemed, 
to most readers, to be a statement of the obvious. The strange 
thing is, the obvious isn't so obvious to security experts. A great 
many secitfity experts think the best way to make sure that 
security holes are plugged as quickly as possible is to get as 
much information as possible to the greatest number of people 
as quickly as possible. In other words, if more people are famil- 
iar with the problem, then more people will work on finding a 
solution. In the meantime, of course, posting that information 
is the equivalent of serving up a bomb for any company that 
has not yet installed the appropriate patches. 
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In July, several websites, following the lead of a "security 
research group" based in China, published the program that 
could allow hackers to gain control of a Windows operating 
system by entering the system through a hole in the Distributed 
Component Objea Model Interface. Malicious hackers could 
put that knowledge to work creating mass-mailer worms that 
move from one computer to the next, leaving havoc in their 
wake. And while none of the code was published until nine 
days after Microsoft had announced the flaw and offered a □ 
patch, the publication ratcheted up the risk for those systems 5 
that had not installed the patch. On the other hand, its publi- z 
cation, and consequent publications (such as this one) about its ° 
publication, helped to warn of what some experts have called z 

o 

the worst Windows security hole in history. 5 
The debate about whether to publish exploit code is clearly Z 
illustrated by the public response to this most recent episode. In d 
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Sound Off 



this case, as in many cases, the first group to publish the code 
was not the group that discovered the flaw. That honor goes to 
a group of Polish experts known as The Last Stage of Delirium 
Research Group, or LSD, which found the flaw more than a 
month before it dutifully sent a message to Microsoft, which 
scrambled to create a patch. As it happens, LSD was not always 
such a good scout. Last April, the group was slammed by secu- 
rity experts after it released exploit code for a devastating Send- 
mail flaw. In response, LSD issued a public statement asserting 
its conviction that failiue to publish detailed information about 
security flaws could be more damaging than publishing. This 
time around, LSD showed the kind of restraint that its critics 
had called for. The result; The group was slammed by security 
experts who agree with LSD's public statement. 

What do you think? Does the publication of exploit code 
help or hinder Internet security? 

Sound Off is a weekly column about current IT-related 
issues. Web Editorial Direaor Art Jahnke (aiahnke@cio.com) 
always welcomes feedback. 

I THINK THIS IS THE WRONG QUESTION. SHOULD THERE BE 

exploits to be published online? is a better question. Just take a 
look at the long list of vulnerabilities published for just the past 
few days on sites such as Symantec. Nearly every major vendor 
of software is listed for some problem. Recenriy, we have had 
major busts on Microsoft and Cisco lOS that have kept my 
folks much too busy, and we no longer seem to have the time to 
test patches before the next one is released. How about a new 
feature in the feature-rich software: no vulnerabilities! 

Gerald McGowan 
Security and Privacy Officer 
Motiette Information Systems 

I FEEL THAT THE QUESTION THIS ARTICLE ALLUDES TO IS MOOT. 

Yes, we can Ic^cally support that it is unethical to post "holey" 
code before giving the vendor a chance to fix it, but honestly, this 
is a refleaion of the world we live in. Get used to it. 

I also sympathize with Gerald McGowan (previous respon- 
der) in that we no longer have time to test before implement- 
ing fixes. The immediacy of patch implementation and the 
frequency with which they are delivered are overwhelming. I 
applaud Microsoft and others for building very complex, 
feature-rich OSs and apps, but I lament the fact that I need to 
"manage" security patch updates weekly across the enterprise 
as part of my scheduled tasks. 

Posting "at risk" code prior to 
notifying the vendor is selfish, short- 
sighted and malicious. People who 
do so should be penalized. Hackers 
don't think ahead to recognize the 



Share Your Opinion 



Want to SOUND OFF on this or other 
topics? Join the ongoing debates at 
www.cio.com/soundoff. 

cio.com 



billions of people whose lives are damaged by each attack. Their 
limited vision provides them only with glimpses of short-term 
authority absent long-term responsibility and consequences. 

We as IT must maintain vigilance on all fronts. We owe it to 
our organizations, families and coworkers. 

The question is no longer should buggy code be posted for 
all to exploit, but how do we defend against the inevitable? 

James A. Taylor 
CEO 

A I Company, com 

WHILE I STRONGLY AGREE THAT WE HAVE TO ALERT THE 

masses that a danger exists, I just as strongly believe that pub- 
lishing the code gives even the most novice hacker the keys to the 
cit>'. That places many more systems in danger than is necessary. 

Microsoft isn't the only bad guy in this situation. We need to 
take some of the blame as we continually want bigger, fastei; 
more fully integrated systems that will work with anyone's 
hardware and software and be completely secure. 

We need to slow down on our requests for more and biggei; 
and instead require more secure. If we stop buying more — ^and 
only more secure — it will get their attention. 

Robert Graves 

Mamger, Network Administration and Security 

HOW THIS THING WITH MICROSOFT WORKS: L THEY DEVELOP 

software. 2. They sell the software to me. 3. The software has 
lots of bugs that damage my business. 4. TTiey then demand 
that I pay an annual maintenance fee to fix the bugs (MS- 
Technet is not free). 5. Instead of fixing the bugs, they develop 
a new version. 6. Instead of giving me the new version, they 
sell it to me. 7. I notice that many of my old applications no 
longer work. 8. I have to buy new versions of the languages 
(databases, whatever) needed to make them work. And guess 
what! I have to buy all of this from Microsoft. 9. 1 then have to 
fund the reprogramming and testing of replacement software 
(talk about a lack of ROI here!). 10. Then the cycle starts over. 

Should they be responsible for the security bugs? They 
should be responsible for all bugs. But, unfortunately, our lax 
government is not willing to enforce the antitrust acts against 
a monopolist. 

Jim Smith 

Management Consultant 

SUFFICIENT INFORMATION SHOULD BE PUBLISHED TO ALLOW 

users to determine if they need a fix or patch, but not enough 
information to give anyone enough to exploit that code. 

Robert Firestone 
President 

Systems Developmettt Enterprises 
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The Power of Now 



Cli dterial 



From the Publisher 

gbeach@cio.com 



Beware of the 
Telephone 

I RECENTLY ATTENDED a presentation by Kevin Mitnick, the infamous 
and reformed hacker and president of Defensive Thinking, a 
consulting and training company aimed at helping clients pre- 
vent information theft. His topic was social engineering, a con- 
cept focused on what Mitnick considers to be the weakest link 
in corporate infrastructure security — human beings. 

According to Mitnick, too few companies have stringent 
security governance policies and procedures in place. Informa- 
tion is not valued, and most employees — besides receiving 
e-mails from the IT department about this virus or that — are 
clueless as to the real threats of damaging security breaches. 

Most employees think of hacks originating via a computer. 
Wrong, says Mimick. He jKjints the most damaging finger at 
the telephone, a device preferred by social engineering hacks to 
extract small pieces of seemingly useless information that they 
can then piece together to cause catastrophic security breaches. 

Telephone-enabled hacks are preferred by the really smart 
bad guys over computer hacks because there is less of an audit 
trail. Moreover, telephone break-ins work against any com- 
pany regardless of its tech infrastructure. 

According to Mitnick, social engineering hacks target four 
typical categories of employees: low paid employees and staff 
with low morale; executive gatekeepers; remote office workers; 
and new hires. To prevent security breaches, Mitnick encour- 
ages people never to share or transmit their e-mail or network 




log-in passwords. He recommends companies pay particular 
attention to remote workers by counseling them to be espe- 
cially vigilant in protecting remote access dial-in data. He 
advises companies to put generic e-mail addresses on their web- 
sites such as sales@cio.com rather than revealing the real 
e-mail addresses of real employees (gbeach@cio.com). If a 
sophisticated hacker can easily guess your company's e-mail 
nomenclature, that hacker can do lots of damage fast. 

Social engineering criminals are adept at surveillance tech- 
niques, and they are also experts at exploiting human trust. 
Plus, they are avid readers of IT employment ads in local news- 
papers or sites like Monster.com — ads that often provide great 
detail on the tech infrastructure in place at their intended tar- 
get. Paper shredders, too, might be a good deterrent; according 
to Mimick, hackers are skilled Dumpster divers! 

Feeling secure? Several months back, this column suggested 
the formation of the Security Underwriters Laboratories, or 
SUL (see "Certify Security," ivunv.cio.com/printlinks), a group 
that would focus a great deal of energy in auditing security 
governance policies and procedures. Too many companies are 
penny-wise and pound-foolish when it comes to addressing 
their most vulnerable security threat: employees. A strong SUL 
would address that need. Drop me a note with thoughts on 
how collectively we can get the SUL started. 

As Mitnick is fond of saying, "There is no patch for stupidity." 
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When there are no words, 
there is action. 



The atrocities committed in New York, Washington, D.C. and Pennsylvania have 
left us all speechless and searching our souls. Mothers and fathers, friends and loved 
ones, are lost under mountains of concrete, steel, and hatred. As the dust settles 
and the tears flow, United Way is there, lending a helping hand with compassion 
in action. But the commitment doesn't end there. Across America, 1400 local 
United Ways are helping families and children cope, providing counseling, and 
promoting tolerance and anti-violence in our communities. Please join the cause. 

To find out how you can hdp your communis heal, log on unitedway.org. 
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Secrets to Managing Techies 

IT employees are different. Here's how to lead them. 
BY MEGAN SANTOSUS 



If you want to be a better leader of your 
IT staff, then it's best not to rely on that 
staple of leadership books, the profiles 
of military leaders such as Attila the 
Hun, George Patton or Colin Powell. 
IT employees don't respond well to a 
leadership style based on power and con- 
trol. That's because IT work — program- 
ming, systems analysis, troubleshooting 
and the like — is centered on individual 
problem-solving that can't be directed 
from above. 

Since IT work is inherently creative, 
effective leadership of IT workers means 
facilitating work that is often chaotic and 
goals that are rife with ambiguities. The 
context of leading an IT organization 
includes aligning IT projects with busi- 
ness strategy, conveying direction to IT 
employees that's consistent with that 
strategy, and keeping IT employees 
focused on end user needs. 

Some big-picture leadership skills, such 
as communication, vision and negotiation, 
are the same whether one is a CEO or a 
CIO, says Paul Glen, author of the recent 
book Leading Geeks: How to Manage 
and Lead the People Who Deliver Tech- 
nology. "At its heart, leadership is all 
about relationships with people," he says. 

But IT leadership skills diverge into 
unique territory when CIOs are immersed 
in the day-to-day operations of an IT 
department. They must motivate IT 
workers who thrive on challenges and 
aren't primarily driven by monetary car- 
rots or perks, and who love technology 
but sometimes need to be pushed to 
apply it in ways that help others do their 
jobs. What's more, many CIOs (who still 
tend to come up through the IT ranks) 
make the mistake of focusing on technol- 



ogy rather than employees. Glen says. 

No wonder that in a recent CIO sur- 
vey, underlings don't give CIOs high 
marks for leadership. Of the 400 partic- 
ipants in our online "What Do You 
Think of the CIO?" survey, only about 
half said their CIOs foster a team envi- 
ronment, use praise and constructive 




Documentum CIO George Lin bans all tech 
talk among IT staffers until they understand 
the business effects of a project. 

feedback to motivate, and delegate effec- 
tively {for the complete survey, go to 
www.cio.com/printlinks). Here's how to 
get on the right side of that divide. 

Embrace Your Inner Techie 

They might bristle at stereotypes, but FT 
employees do share certain tendencies 
that set them apart from workers in sales, 
finance and manufacturing. As creative 
problem-solvers, IT staffers get absorbed 
in whatever projects they are working on, 
often at the expense of relating to col- 



How comfortable do you 
find the liot seat? E-mail 
Leadership and Management 
Editor Edward Prewitt at 

hotseatttcio.com. 
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I I leagues outside of IT. 

ff 1 1 As technology afi- 

I cionados, IT employ- 
^^ ^IT sometimes don't 
!■ iiave much patience 
with people who don't 
share their enthusiasm for all things tech- 
nical. And when it comes to organiza- 
tional politics and Machiavellian 
maneuvers, most IT people couldn't be 
bothered. For their part, employees out- 
side of IT may not appreciate the nature 
of rr work, so CIOs need to serve as a 
bridge between disparate groups. 

Grasp the traits that make IT employees 
tick to provide them with direction, moti- 
vation and goals. Kevin Ori; a former CIO 
for the Army hospital at Fort Rucker in 
Alabama, finds parallels between IT work- 
ers and artists. "FT people tend to work in 
tremendous spurts interspersed with dry 
spells," he says. Currently a systems engi- 
neer at Northrop Grumman Mission Sys- 
tems, Orr says it's essential that CIOs 
provide FT employees with clear guidelines 
on tasks and communicate overall goals. 
But when it comes to the day-to-day work, 
CIOs need to let IT employees pace them- 
selves as long as quality and deadlines 
aren't compromised. Yet even CIOs who 
enjoy an insight into the FT mind worthy 
of Freud won't get far if they lack credi- 
bility and respect from their staffs. That's 
where technical knowledge comes in. 

As far as leadership goes, "the major 
difference in being a CIO compared to a 
CEO is that IT people have little toler- 
ance for anyone who doesn't understand 
what they do," says Steven Steinbrechei; 
former CIO of Contra Costa County in 
California. "If they think you are tech- 
nology-stupid and they can buffalo you, 
they will." Steinbrecher, who retired in 
July after nearly 30 years in IT, says that 
in every CIO job he's had, at least one 
employee showed up at his office within 
the first few weeks to test his knowledge. 

Jeff Chasney, executive vice president 
and CIO of CKE Restaurants, sounds a 



similar note. "Credibility is the key sepa- 
rating effective leaders from less effective 
ones," he says. "If you have a baseline of 
knowledge, if you question IT employees 
on their assumptions, they'll develop a 
deep appreciation for you." 

The depth required for a CIO's tech- 
nical knowledge depends to a great 
extent on the size of the organization. 
When complemented by a CTO, CIOs 
can succeed with less technical acumen 



units. Techies may think the world 
revolves around technology, but it's the 
CIO's job to make sure technology takes 
a backseat to business needs. CIOs 
should constantly hammer this message 
home in a way that doesn't ruffle any 
IT employees' feathers. George Lin, vice 
president and CIO at Documentum, a 
provider of content management soft- 
ware, keeps business needs at the fore- 
front by banning technology talk with 



MANAGING YOUR I.T. ORGANIZATION 

Four Essentials for Leading Techies 

IN HIS BOOK Leading Geeks: How to Manage and Lead the People Who Deliver 
Technology, self-described geek and consultant Paul Glen identifies four actions 
indispensable for CIOs who hope to lead IT staffers. 

1. Motivate the ranks. Avoid incentives designed to promote certain behavior 
(for example, staff the help desk 12 hours a day) and concentrate instead on 
creating conditions (such as establishing career paths and setting achievable, 
measurable goals) under which motivation can develop. 

2. Facilitate teamwork. IT staffers shouldn't work in isolation. It's your job 

to encourage and coordinate the free flow of ideas and activities among the 
various IT teams. 

3. Publicize achievements. Let the business side know exactly how IT 
contributes to the strategic goals of the organization. 

4. Provide clarity. So that IT employees aren't working in the dark, explain the 
goals of your department, highlight project priorities and outline individual 
responsibilities. 



as long as they understand how IT work 
gets done. At bottom, "the FT staff needs 
to know that the individual leading the 
organization, setting the strategic direc- 
tion and working with customers is 
someone who understands what it takes 
to make IT happen," says Terese Butler, 
the deputy director of FT at California's 
Employment Development Department. 

A high-level understanding of tech- 
nology is essential for another reason as 
well: the CIO's role of intermediary 
between the IT group and business 



his IT employees. "I never talk technol- 
ogy to my own people," he says, opting 
instead to "talk about how their work is 
related to the business." 

To discourage conversations focused 
on technology, Lin demands that his 75 
IT staffers first understand the business. 
In tackling a systems integration proj- 
ect, for example, Lin requires FT folks 
to first draw out the entire business 
process flow involved in the project 
before they can focus their attention on 
specific EAI tools. 
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I I ■ Know Where IT 

MQT Should Go 

. When it comes to 
£^ ^IT rnotivating IT workers, 
V^%^ ^ a hands-off philosophy 
works best. "If you 
know how to work with techies, they are 
the easiest kind of employees to motivate," 
says Chasney. "They don't need cushy 
perks, personal recognition or bonuses; 
they thrive on creatively solving prob- 
lems." When CKE Restaurants recently 
launched a projea to retrofit DOS-based 
software onto new Windows-based point- 
of-sale hardware, Chasney challenged his 
team to come up with a way to do it with- 
out cracking the existing code, an approach 
that required heavy-duty technical wran- 
gling. By encouraging his people to look at 
the problem in a different light, they came 
up with a simple, elegant solution in two 
days. Chasney's lesson: Don't tell FT people 
how to solve a problem. Plant an idea of 
where you want them to go, give them the 
resources they need, and let them find their 
own path to the solution. 

One ongoing leadership challenge for 
CIOs is communicating how IT con- 
tributes to the business. This Isn't only 
about establishing ROI (although that's 
always a bugbear); it's about boosting the 
morale of IT employees by showing them 
how their work aids and abets business 
performance. "Evaluating and recognizing 
our contribution is tough in IT because 
we're a couple of steps removed from the 
end result," says Tim Buckley, managing 
director of IT at financial services com- 
pany The Vanguard Group. With a typi- 
cal project lasting 12 to 18 months, IT 
employees don't always see how their 
work pays off. That's a problem when the 
IT department itself is judged on how 
effectively it supports the business. CIOs 
have to highlight ITs contributions to both 
employees and business users. "It comes 
down to communicating overall organi- 
zational goals and showing employees 
what their roles are in [fulfilling] those," 



MANAGEMENT REPORT 

The Loyalty Lag 



Ten Ways to Develop the 
Truly Loyal Employee 

Employees who stay put should not be 
confused with those who stay loyal, 
according to a new, comprehensive 
study of worker attitudes In business, 
nonprofit and government organiza- 
tions. Walker Information, a research 
company specializing In loyalty and 
satisfaction measurements, released 
a workplace loyalty report In Septem- 
ber. The study distinguishes the "truly 
loyal" employees from those who stick 
around only until a better job comes 
along or those workers who feel 
trapped In their jobs. 

Only the truly loyal workers will go 
the extra mile to delight customers 
and are highly motivated in their work. 
These employees also would resist 
offers of other jobs and would recom- 
mend their companies to potential 
employees. Too bad they're so scarce. 
Only 30 percent of survey respon- 
dents met the criteria. Even so. Marc 
Drizln, a vice president at Walker and 
the company's loyalty specialist, finds 
this percentage surprisingly high, 
especially in light of the recession. His 
explanation Is that employees who 
have lasted through layoffs sometimes 
feel gratitude and obligation toward 
their companies. 

On the other side of the coin, 34 per- 
cent of respondents were classified as 
"high risk" (meaning they were neither 
committed to their work nor planning 
to stay with the company for the next 
two years), and another 31 percent 
qualified as "trapped" (not attached 
to their work or employer but without 
prospects for other jobs). So what 
management actions produce the 
truly loyal employee? 



Walker measured the attributes of 
the truly loyal along two dimensions: 
experiences and attitudes. When it 
comes to employees' personal experi- 
ences of their workplaces, the top five 
drivers of loyalty are: 

1. Care and concern that the employer 
shows for workers— displayed by 
working conditions, policies and 
style of management. 

2. Falrnessof pay and evaluations. 

3. Employees' feelings of accom- 
plishment In their work. 

4. Satisfaction with daily activities. 

5. Management appreciation for 
employees' Ideas and input. 




Regarding employees' attitudes 
about their work and workplaces, the 
top five drivers of loyalty are: 

1. An employee-focused atmosphere 
In the office— demonstrated by a 
clear priority put on staffers. 

2. Development opportunities- 
evinced by training. 

3. The quality of the employee's job. 

4. Thecorporatebrand— thatis, how 
the employee feels about It. 

5. Personal sacrifice required for the 
job— that Is, the so-called work-life 
balance. 

-Edward Prewitt 
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I I says Butler. To show- 

f 1 1 case the role of IT to 

I the business side at Cal- 
^^^J^^IT ifornia's Employment 
V^^^ V Development Depart- 
ment, she has invited 
developers to give project demos to execs, 
making sure to emphasize how the projea 
improves productivity. 

IT staffers place great value in ongo- 
ing training, but typically it's technical 
updates they want, not management 
training. Ideally, your workers should 
develop skills that build professionalism 
in the IT group and align with the com- 
pany's needs. At Documentum, where the 
business side puts a premium on soft 
skills such as customer service and nego- 
tiation techniques, Lin works with the 
HR department to provide IT people 



'If you know how to 
work with techies, 
they are the easiest 
kind of employees 
to motivate. They 
don't need cushy 
perks; they thrive 
on creatively 
solving problems." 

-Jeff Chasney. executive 
vice president and CIO, 
CKE Restaurants 



with training in those areas. "Without the 
soft skills, IT people won't be very suc- 
cessful working with our internal cus- 
tomers," Lin says. 

The CIO's ultimate role is to harness 
technology for the organization's best use. 
The most successful CIOs know what 
motivates their staffs and how to lead 
them toward success. BEl 

Send your feedback to hotsea(@cio.com. Opinion 
and Knowledge Management Editor Megan 
Santosus can be reached at santosus@cio.com. 




Leadership Agenda bysusanh.cramm 

TheM.I.A.CIO 

Five ways to regain your focus — and retain your job 

You are in a funk. Your work has turned into a grind, your 
calendar is out of control, and issues are grow/ing into 
problems. The focus and energy that you once had are 
dissipating. People in your organization have noticed— 
they describe you as distracted, disengaged and tense. 
You are the missing-in-action CIO— present in body but 
not in mind and spirit. 
You are not alone. Ninety percent of professionals are living a less than 
purposeful existence— either in a state of disengagement, distraction or 
procrastination— according to Heike Bruch and Sumantra Ghoshal, authors 
of "Beviare the Busy Manager" (Harvard Business Review, February 2002). 
What state you find yourself in, say the authors, depends on the relative levels 
of two factors: focus, which is "the ability to zero in on a goal and see the task 
through to completion," and energy, defined as "vigor that is fueled by intense 
personal commitment." 

Most likely, you started off in your current position with a strong sense 
of purpose and the ability to see problems and solutions in stark relief. You 
defined and tackled your laser-sharp agenda with limitless energy and enthu- 
siasm. But as time passed, you lost interest or ran into obstacles or got 
overloaded and joined the suffering 90 percent. 

Great leaders understand how to renew their leadership agenda. They have 
the self-awareness and self-discipline to identify and overcome their malaise. 
Many of us have used job-hopping as a primary means of leadership renewal. 
Although crude (in that it does not force you to face the root causes of your 
leadership malaise), it is effective— as long as there is a strong job market and 
you are a hot commodity. Now more than ever, given the weak economy and 
aging demographic, the ability to renew your focus and energy and regain 
your purposeful footing is important. If you are ready to take back your job, 
here's what you should do. 

MAKE THE TIME. It should come as no surprise to learn that purposeful 
leaders schedule time on their calendars to think and reflect. Many hectic 
managers find this task almost impossible and require outside assistance 
from a trusted adviser to help them do calendar analysis and surgery. Since 
your schedule consists primarily of meetings, the easiest way to make time is 
to reduce the frequency and duration of meetings (try saying, "When someone 
asks for one hour, they get half an hour"), eliminate certain meetings ("I don't 
meet with vendors") and activities ("My assistant answers my phone and 
reviews e-mails" or "I read e-mails and check voice mail once a day"), and 
delegate project work that you have picked up along the way. 

OPEN YOUR EYES. Balanced feedback will motivate and sharpen your 
focus and build your commitment on the issues and opportunities that need 
to be addressed. Go regularly to the front lines of your organization (where 
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Finally, a company that talks big and 
works bigger. A company that talks ROI 
and actually delivers. A company that 
provides real business value you can 
measure. A network solutions and 
services provider called NextiraOne. 

At NextiraOne, we bring clarity to your 
complex communications networks. 
Planning, designing, implementing, 
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data and converged infrastructures. 
In the United States or around the 
world. You name it, we do it - with 
world-class results. 

www.NextiraOne.com (888) 888-1055 



I I your employees 

II interact with their 

I customers and 

suppliers) to assess 
!■ your positioning and 
identify opportuni- 
ties around shareholder value, cus- 
tomer service and cost-effectiveness. 

GET OTHERS INVOLVED. Leaders 
aren't expected to have all the answers, 
and leadership is not a solitary pursuit. 
A collaborative process of defining 
goals, strategies, priorities and tactics 
will strengthen commitment, increase 
your influence and energize everyone 
involved. In addition, if you are risk- 
averse, sharing priorities and responsi- 
bilities will go a long way to quiet your 
fears about the career impact of set- 
backs and failures. For more informa- 
tion on strategy-making, see my 
previous column, "Strategic Fitness," 
at www.cio.com/printlinks. 

EXPRESS YOURSELF. Someone 
once said, it is easier to maintain 
your focus and energy if your career 
expresses who you are rather than 
what you do. Look at a CIO who is an 
adrenaline junkie (with hobbies like 
car racing, flying and downhill skiing). 
The CIO role is going to drive him crazy 
unless he figures out a way to keep 
initiatives on a fast cycle time and lets 
people with a longer attention span run 
operations. 

WORK WITH A NET. If the prospect 
of losing your job makes you queasy, 
you need a safety net that gives you 
the freedom to define your leadership 
focus and approach. Some of you are 
blessed with a mental safety net (your 
outlook is that "everything is going to 
be OK"), while the rest need some- 
thing more tangible— safety nets that 
ensure that your financial needs will be 
met. There's nothing like money in the 
bank and the ability to earn a living as 
a contractor or consultant to give you 
the courage to take risks, make hard 



decisions and negotiate effectively. 

The leadership renewal process I've 
outlined here requires that you leave 
your "old" job, assess your effective- 
ness, and replace yourself with a more 
effective successor. Do yourself and 
your organization a favor: Mentally fire 
yourself today and walk in tomorrow 
like it's your first day on the job. 

Reader Q&A 

Susan H. Cramm answers 
questions on "The M.I. A. CIO" 

Q: Your article describes my situation 
perfectly. I am a CIO for a very success- 
ful financial services company. My job 
is very challenging, rewarding and 
boring. I have built a great working 
relationship with my boss (the CEO) 
and other executives. However, I am 
finding myself losing more interest day 
after day. I want to quit my Job alto- 
gether and join a small startup where 
I can expand my responsibility over 
other areas such as sales and market- 
ing, product development, and opera- 
tions. Do I exhibit typical signs of 
burnout, or am I just going through a 
midlife, midcareer crisis? 
A: Don't ignore your current feelings, 
but don't change for change's sake. 
Base any actions on insights on your 
skills, knowledge, talents, motivators, 
likes and dislikes, and practical consid- 
erations regarding financial security, 
prior experience, networking and 
reputation. I am currently working with 
a client who wants a change but is 
security-minded given his family 
responsibilities. We have identified his 
career goal and opportunities within his 
current company that will help move 
him forward. For more information on 
defining your career destination and 
plan, please read one of my previous 
columns, "Is This Job All There Is?" 
{www.cio.com/printlinks). 



Q: A couple of things are missing from 
your list of what to do. A focus on family 
and friends is more important than 
spending all my energy at work. Those 
are the true lasting relationships. It's 
there that I gain my energy to work. My 
family members also help me focus on 
work because of the importance of 
supporting them. Also, you neglected 
outside interests; hobbies, sports and 
so on are how people recharge them- 
selves. Life isn't all about work. 
A: Congratulations! It sounds to me 
like you are a proud member of the 
purposeful 10 percent. In your case, 
you express yourself by ensuring that 
your work supports your desire to 
nurture and support your family and 
foster relationships. My guess is that 
your focus on relationships is something 
that is part of your personal DNA and 
that you are able to express it on a day- 
to-day basis in your job. It's true that life 
isn't all about work. It's also true that if 
you are spending 10 hours a day doing 
things that don't feed your soul, you will 
ultimately join the suffering 90 percent. 

Q: Most of us are disengaged, dis- 
tracted or procrastinating. Can any- 
body really avoid that? I don't know 
anyone in that 10 percent group. 

A: It is true that the purposeful 
10 percent are the enviable minority. 
Regaining purposeful footing is difficult 
because the catalyst for change must 
be created internally. The renewal 
process requires the self-awareness to 
identify the need for change, the self- 
discipline to work through the discov- 
ery process, and the self-confidence to 
put your insights into action. BE] 

To see more reader questions and answers 
from Susan H. Cramm. go to www.cio.com/ 
leadership/agenda.html. Cramm is president of 
Valuedance, an executive coaching firm based 
in San Clemente, Calif. Her e-mail address is 
scramm@cox.net. 
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End-to-end business intelligence. 
One BI vendor. IT nirvana. 



s 



Business Intelligence /rom Business Objects 



There are basically two ways for IT to implement 
your enterprise business intelligence solution. 
You could try to cobble together pieces from 
multiple vendors. Or you can choose 
BusinessObjects ' Enterprise 6 from 
Business Objects. And experience 
end-to-end business intelligence 
for your entire enterprise. 




1^ m 



Data Sources 



With Enterprise 6, you'll be able to provide a 
complete suite of integrated business intelligence 
software that meets the needs of all your users. 
It includes the industry's best web query, 
reporting, and analysis capabilities. The most 



advanced and complete suite of analytic 
applications. The best packaged application 
connectivity. And, of course, end-to-end product 
integration. Today, more than 17,500 
companies rely on award-winning 
Business Objects business intelligence 
solutions to track, understand, and 
manage enterprise performance. 
Perhaps you should, too. To get started, view our 
BusinessObjects Enterprise 6 interactive product 
demonstration or download our free technical 
white paper at www.businessobjects.com/e2e. 
And indulge yourself in IT nirvana. 
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"The discussion and 
information exchange 
with peers is invalu- 
able." 

Rotjert Odenhelmer. 
SVP, IT Operations. 
Magellan Behavioral Health 



"The content presented 
by Peter Weill was an 
excellent framework to 
discuss current chal- 
lenges with a very 
interesting 
peer group." 

Chris Acton, Global IS. 
Rio Tinto Borax 



"Lessons learned are 
not the usual aca- 
demic fare, but the 
subtleties of the cul- 
tural and technological 
minefields." 

Evelyn Lockett Woods. 
EVP/CIO. Joint Commission on 
Accreditation of Healthcare 
Organizations 



Call 

800.355.0246 
or visit us at 
www.cio.com/ 
conferences . 





Retreat Moderator 

Peter Weill 

Director, Center for 
Information Systems 
Research, MIT Sloan 
School of Management 



The Case 
Studies 

Peter Weill once again presents 
new findings and case studies 
from work with hundreds of 
Global 1000 companies, focus- 
ing on three key areas: IT infra- 
structure for strategic agility, 
effective business models, and 
IT governance. 

> IT Infrastructure for 
Strategic Agility 

Strategic agility - the ability to 
implement new business initia- 
tives quickly and cost effectively 
—will be an increasingly impor- 
tant capability for enterprises in 
2004. IT infrastructure is one of 
critical platforms required for 
strategic agility. Investing in the 
right infrastructure at the right 
time enables rapid implementa- 
tion of future electronically 
based business initiatives and 
cost reduction of current busi- 
ness processes— i.e.. more busi- 
ness value. This session 
presents a framework for senior 
executives to view IT infrastruc- 
ture in business terms and to 
lead in making investment deci- 
sions. Weill illustrates how firms 
successfully implement and 
exploit their IT Infrastructures 
with several case studies. 

> Do Some Business 
Models Perform Better 
than Others? 

In an increasingly connected 
business world the business 



model— what a firm 
does and how they 
make money— is a 
critical strategic 
decision. Under- 
standing what busi- 
ness models are 
used, how they are 
combined, and which are most 
successful is important for every 
senior manager. In addition, 
firms implementing each model 
use IT differently— resulting in 
different IT portfolios. This pres- 
entation provides a new and 
powerful way to analyze a firm's 
business model and then think 
about the IT needs. 

> IT Governance Workshop 

In response to strong interest in 
last year's session on IT gover- 
nance. Weill leads a workshop 
on how top performers govern. 
He presents case studies and 
insights from MIT ClSR's study 
of effective IT governance in 256 
enterprises in 23 countries. A 
framework is presented in this 
workshop to analyze and com- 
municate governance, illus- 
trated with cases studies of top 
performers. 

> Monday's Case Study 
Workgroups 

Monday at lunch we divide into 
small groups to investigate the 
link between business strategy 
and IT infrastructure in a new 
case study. The case Is based on 
a global multi-business unit firm 
in the healthcare industry mov- 
ing from a fully decentralized 
approach to information tech- 
nology to providing some firm- 
wide IT infrastructure. The 
challenge for your group is to 
advise the newly appointed 010. 
Groups will report back with 
their recommendations. 



The Enterprise j 
Value Award ■ 
Winners 

They're scrutinized by C/Oedl- > 
tors. Review Board members, 
and our judging panel of top- 
notch ClOs. Meet the winners ofi 
the prestigious CIO Enterprise j 
Value Award and learn how the/ 
delivered true value. '■ 



> The Value Proposition 

Our panel of ClO Enterprise 
Value Award winners talks about 
the ongoing difficulty inherent in 
demonstrating and delivering IT 
value. How do you convince your 
CEOs. CFOs and COOs-who 
may think IT is just a commodity, 
a utility— that its intelligent 
application and deployment 
can and does indeed bring 
strategic value to the business. 



> Conversations with 
This Year's Winners 

We offer breakout sessions with 
the ClOs of this year's winning 
organizations. It's your chance 
to talk at a more intimate level, 
discuss their particular case in 
more detail and take away les- 
sons you can apply to your own 
organization back home. 



> Monday Night's Gala 
Awards Ceremony & 
Dinner 

We'll announce the winner of 
the Grand CIO Enterprise 
Value Award— and honor all 
the winners in the industry cat- 
egories at a black-tie recep- 
tion, awards ceremony and 
dinner. It's a great time to cele- 
brate with your CIO peers. 



The Peer 
Networking 

ClOs tell us it's as important to 
have opportunities to meet infor- 
mally with their peers as it is to 
participate in the Retreat ses- 
sions. We give you more oppor- 
tunities to meet and learn from 
more of your peers over three 
days, with the golf tournament 
Sunday morning, informative 
chats at breakfast and lunch 
roundtables. the intensely inter- 
active case study workgroup ses- 
sions, and relaxed conversations 
during the daily receptions. And 
we're happy to hook you up with 
other attendees or corporate 
sponsors you'd like to meet. 
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It's time for the death of fingerpointing 




1 wireless vendor + 1 wireline vendor + 1 problem = multiple places to place blame. That's when problems 
can really multiply. And that's time for Sprint. Sprint built its wireline/wireless network from the ground up. 
Designed it specifically for greater reliability and security. We stand behind it. And our industry-leading 
SLAs back it up. Let us show you how end-to-end accountability works. Especially if you have a network 
that doesn't. It's time for Sprint Go to sprintbiz.com/time, or call 1 866 629-5023. 



Sprint 



One Sprint. Many Solutions." 
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COVER STORY I Web Services 
Standards Battle 

Christopher Koch I 54 

The year 2003 will not be known as 
the year of Web services; more likely, 
it will be remembered as the year the 
standards process began to fall apart. No 
fewer than four organizations — Liberty 
Alliance, Oasis, W3C and WS-1 — are vying 
to preside over the process, each with differ- 
ent goals and degrees of power and influ- 
ence. Uneasy and fragile alliances quake 
under the pressure of enormous revenue 
potential, and bickering seems to doom the 
outcome, promising a proliferation of con- 
fusing, duplicative Web services standards 
emerging in the next few years. Some will 
be proprietary, and some will not, with 
unclear patent and licensing implications 
for CIOs. And the ultimate result will be a 
lot of wasted money for CIOs. Though some 
practitioners, including Fidelity, GiM, J.P. 
Morgan Chase and Kaiser Permanente are 
participating in standards bodies, it's a time- 
consuming commitment, so vendors con- 
tinue to dominate. If CIOs remain on the 
sidelines, they will end up forced to choose 
from among multiple Web services standards 
that may not interoperate, may have limited 
life spans, and may come with fees or other 
onerous patent and licensing requirements. 

'*The structure of these 
groups is backward. The 
users should be the ones 
creating the standards, 
and the vendors should be 
adopting them. Right now, 
users have to take what 
the vendors feed them." 

-Eric Austvold, 
research director for AMR Research 



Web Services Risk Mitigation ByEianaVaron I 64 

MANY COMPANIES THAT HAVE EXPERIMENTED with Web services are beginning to put 
pilot projects into production. The smartest — including Motorola, the U.S. Navy and Wells Fargo — 
are taking an enterprise view, developing policies for the technology's strategic use that take into 
account its effea on existing IT infrastructure and applications. Their strategies seek to mitigate the 
five major risks of Web services: lack of security, unsettled standards, questionable vendor viability, 
uncertain adoption by trading partners and lack of enterprise ROI evidence. For example, the Navy's 
coping strategy is to use its market influence with standards organizations to cajole vendors into sup- 
porting as many of the emerging standards as possible. The Navy's vendor neutrality presumes infra- 
structure vendors will eventually provide produrts to work with any standard and therefore mean 
easy integration. Motorola has decided to hedge bets by investing in both Sun's and Microsoft's com- 
peting Web services development platforms. 

It Ain't Over Until You Do the PIA ByMeridith Levinson I 74 

ALTHOUGH ONLY 20 PERCENT of IT shops in the general population perform post-imple- 
mentation audits (PIAs) on IT projects, 66 percent of companies honored with the CIO 100 Award 
for resourcefulness this summer routinely condua audits. That ought to tell you something. PIAs 
are among a resourceful company's best tools for proving the value of high-cost, mission-critical IT 
investments and for gleaning project management best practices, which CIOs can then apply to 
subsequent projects. Companies, including manufacturer Greif, Honeywell Aerospace and Sun Life 
Financial, have found ways to overcome political and resource hurdles to make audits a routine proj- 
ect management practice. They've figured out the best timing for audits, who should conduct them, 
how to make the findings actionable and how to incorporate learning back into project practices. 

The Business Education of Jan Franklin By Alice Dragoon I 84 

FRANKLIN SPENT ONE AND A HALF YEARS as an executive director on the business front 
lines before becoming CIO of Farmers Insurance, an experience that yielded valuable lessons for any 
CIO. Once known as a no-nonsense manager with little patience for office politics or excuses, Franklin 
realized the importance of listening to those in the field. She introduced metrics to the service center she 
managed, a concept that took getting used to for some, but even initial measurements showed improve- 
ments. Howevei; she learned that metrics don't tell you everything: A seemingly innocuous system hic- 
cup can have a huge impact on customer service. Above all, she's learned a new style, one that's much 
more collaborative. Nowadays, she's more likely to coach than dictate. 

Hot Seat: Secrets to Managing Techies By Megan Santosus I 98 

ClOS WHO WANT TO BE EFFECTIVE LEADERS need to emulate psychologists rather than 
sergeants. IT employees don't respond well to a leadership style based on power and control. That's 
because IT work — programming, systems analysis, troubleshooting and the like — is centered on indi- 
vidual problem-solving rather than activities that can be directed from above. CIOs must facilitate 
work that is often chaotic and goals that are rife with ambiguities. Their leadership goals include align- 
ing IT projects with business strategy, conveying direction that's consistent with that strategy and keep- 
ing IT employees focused on end user needs. Too often, though, CIOs (revealing their roots in the IT 
ranks] make the mistake of focusing on technology rather than employees. Finally, when it comes to 
developing IT career tracks, CIOs have to take the lead: IT workers — motivated more by technology 
than status or ladder-climbing — often treat career development as an afterthought. 
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REI WORKS WITH QWEST 

Cutting-edge technology is vital to winnii ■ >, but it's only half of the package. You need great 

people and great service to nnake it all come tc That's what we believe at Qwest, and we prove it every 

day to companies like Recreational Equipmein. Inc. When they said "no downtime," Qwest listened and 
delivered. We implemented a complete Dedicated Internet Access solution for REI, beating their delivery 
date by two weeks. With this service up and runninq. REI's Internet sales continue to see double-digit growth 
year after year. Their success is our succ iip that continues to this day. It's our Spirit of 

Service" commitment. And it's what sets us apart. 




Di A LEADING 
UTDOOR OfTFITTER 
UTFITITfkCOMMUNICA 

network:?" 

Janie Scarborough, Global Account Manager, Qwest Communications 




ONS 




To find out how we can put the Spirit of Service to work for you, 
visit us at qwest.com/bizspirit or call us at 1 800-506-0663. 



fQwest^-**^ 

Spirit ot Service" 

VOICE SOLUTIONS 
DATA SOLUTIONS 
INTERNET SOLUTIONS 
MANAGED SOLUTIONS 



Qwest DIA is available tfiroughout the United States, Qwest DIA service also provides tiigti-speed Internet access to more than 240 major cities in 19 European countries. However, customers in the states of 
AZ, CO, lA, ID, MN, MT, ND, NE, NM, OR. SD, UT, WA and WY will have their Qwest Internet services provided in conjunction with a separate Global Service Provider (GSP). This provider will supply 
customers with connectivity to the global Internet. When Qwest receives regulatory relief, it will offer this service without the use of a GSP. ©2003 Qwest Communications International Inc. 




Ever need consultants to figure out 
how much your consultants cost? 



Only PeopleSoft Enterprise Service Automation delivers proactive control over outside services spending. 

PeopleSoft ESA is the only complete solution for managing the expense of outside contractors, consultants 
and temps. It enables you to know exactly who's doing what and how much it is costing. And PeopleSoft ESA 
matches the right skills to the right projects in real time. So you minimize outside services spending, while 
maximizing its value. Learn more by visiting us at www.peoplesbft.com/realtime or call 1-888-773-8277. 



PeopleSoft 



Enterprise Service Automation 



O 2003 PeopleSoft. Inc PeopleSoH is a regislsred trademark ol PeopleSoft. Inc. 



top scores 



m SIX 
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Of our 1900 clients worldwide, 
an impressive number are now 
up and running with Lawson 
client/server open enterprise 
solutions. On SYBASE," 
ORACLE* and INFORMIX? 

According to Computer- 
u'cirld's Guide to Client/Server 
Financial Software, an even 
more impressive number give us 
top scores in all six categories: 
Res/xmsiVeness of SenAce, Ease of 
Use, Overall Reliability, Reporting 
Capabilities, Interfacing with 
Other Applications and Quality 
of Support. In fact, Law.son was 
highest in oieralf satis/action of 
ail the companies surveyed. 

Call us at 1-800-477-1357 
extension 853, and find out why. 
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"The new Informix database server architecture will put the 
vendor ahead of competitors Oracle and Sybase in support 
of multiprocessing systems" 



David McGoveran, Alternative Technologies 



Parallel 

Database 

Technology That's 

As Dynamic 

As Your Organization. 

Recently, Informix Software introduced 
Dynamic Scalable Architecture," a next- 
generation database architecture designed 
to take advantage of parallel processing. 
The result is a technological breakthrough 
in client/server database performance and 
scalability Informix's Dynamic Scalable 
Architecture will run on the entire range 
of new, high-performance open systems, 
from uniprocessors to symmetric multi- 
processors, loosely coupled clusters, and 
massively parallel machines. 

C l»IWoiTO» SohviiT. Inc. Infarma H a n^mtmi tndaiMfi of Iitfixnui Soh*iire, Inc 



John MiMTall, lirtanwtional Data Corporation: 

ttThe Informix Dynamic Scalable Architecture has the 
potential to vault Informix past its primar>' competitors for 
high-end database processing functionality.W 



Peter Kastner, Aberdeen Qroup: 

U Sybase and Oracle lack the clarity of Informix's architecture. 
They're going to have to go back to their labs.W 



Rob Tholemeler, Meta Group: 

« Informix may have the best scalable server technology 
today. . . I think people are mistaken in not taking the time to 
really look at Informix.W 



Qordon Kerr, Senior VP, ManaComent Information Systonw, 
Hyatt Hotels and Resorts: 

ttWhat Informix has done with DSA is make it much 
easier for me to plan for the future. We're beginning to 
deploy symmetric multiprocessing hardware through our 
organization, and I know that if and when we determine we 
need to scale up to loosely coupled or MPP machines, our 
Informix applications will be able to make the move with us.W 



Michael Bloomberg, Bloomberg Hnanelal Market*: 

ttlntormix developed core internal parallelism in DSA, 
which is different than other types of add-on parallel data- 
base capabilities we've seen. Since the parallel processing 
features are internal, rather than external, we're expecting im- 
pressive performance gains. It's clear that Informix thought 
this technology through. W 

Find Out Why DSA" Is So Different. 

We'd like to tell you more about Informix's Dynamic Scalable 
Architecture, including an independent report from the 
Aberdeen Group. Send or call toll-free 1-800-688-IFMX, 
ext. 18 for your free copy. 

rj INFORMIX' 



